domainsellerpro-sql.txt

WwW.StarHack.Us Author : TR-ShaRk Web : StarHack.Us OldKral.Com Email : [email protected] Msn : [email protected] Script : Domain Seller Pro� v1.5 SQL Injection Vuln. : index.php?a=d&id=-4+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14-- Demo :...

HACKATTACK Advisory 20081016]WEB//NEWS SQL Injection and Cookie Manipulation

HACKATTACK Advisory 20081016WEB//NEWS SQL Injection and Cookie Manipulation Details ======= Product: WEB//NEWS Security-Risk: high Remote-Exploit: yes Vendor-URL: http://www.stylemotion.de/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

[MajorSecurity Advisory #56]moziloWiki - Directory Traversal, XSS and SessionFixation Issues

MajorSecurity Advisory 56moziloWiki - Directory Traversal, XSS and SessionFixation Issues Details ======= Product: moziloWiki Security-Risk: High Remote-Exploit: yes Vendor-URL: http://www.mozilo.de/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David...

A4Desk Event Calendar - eventid SQL Injection

A4Desk Event Calendar - eventid SQL Injection source: https://www.securityfocus.com/bid/33835/info A4Desk Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

A4Desk Event Calendar - v Remote File Inclusion

A4Desk Event Calendar - v Remote File Inclusion source: https://www.securityfocus.com/bid/31507/info A4Desk Event Calendar is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

[MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues

MajorSecurity Advisory 54xt:Commerce - Cross Site Scripting and Session Fixation Issues Details ======= Product: xt:Commerce Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.xtcommerce-shop.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered...

[MajorSecurity Advisory #53]BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues

MajorSecurity Advisory 53BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues Details ======= Product: BLUEPAGE CMS Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.bluepage-cms.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...

major_rls53.txt

MajorSecurity Advisory 53BLUEPAGE CMS - Cross Site Scripting and Session Fixation Issues Details ======= Product: BLUEPAGE CMS Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.bluepage-cms.com/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...

PHP Pro Bid 5.2.46.04 - Multiple SQL Injections

PHP Pro Bid 5.2.46.04 - Multiple SQL Injections source: https://www.securityfocus.com/bid/31263/info PHP Pro Bid is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an...

osp-sqlxssxsrf.txt

======================================================================= . .. | | / / | | | | / \ / / /\ / / \ | | | / / \ /\ \| | / // / /\ \ / / / // http://wwwlowsec.org ======================================================================== Author: C1c4Tr1Z Date: 28/08/08...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Envolution: crossite scripting, automation protection bypass...

NewsHOWLER 1.03 - Cookie Data SQL Injection

NewsHOWLER 1.03 - Cookie Data SQL Injection source: https://www.securityfocus.com/bid/30732/info NewsHOWLER is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

itMedia - Multiple SQL Injections

source: https://www.securityfocus.com/bid/30740/info itMedia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

Nortel Networks SRG V16 - 'modules.php?module' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/30687/info Navboard is prone to multiple local file-include vulnerabilities and a cross-site scripting vulnerability. An attacker can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the contex...

Datafeed Studio - patch.php Remote File Inclusion

Datafeed Studio - patch.php Remote File Inclusion source: https://www.securityfocus.com/bid/30659/info Datafeed Studio is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file...

Battle.net Clan Script 1.5.x - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/30565/info Battle.net Clan Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

POWERGAP ShopSystem - 's03.php' SQL Injection

source: https://www.securityfocus.com/bid/30558/info POWERGAP Shopsystem is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2008-3458

Vuln CVE-2008-3458 affects vTiger CRM prior to version 5.0.4 . The issue is inadequate access control that stores sensitive information under the web root, enabling remote attackers to read mail merge templates by directly requesting the wordtemplatedownload directory. This is confirmed across mu...

Team SHATTER Security Advisory: SQL Injection in Oracle Application Server (WWEXP_API_ENGINE)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory SQL Injection in Oracle Application Server WWEXPAPIENGINE Audust 4, 2008 Risk Level: High Affected versions: Oracle Application Server 9.0.4.3, 10.1.2.2 and 10.1.4.1 Remote exploitable: Yes No authentication required...

Pcshey Portal - 'kategori.asp' SQL Injection

source: https://www.securityfocus.com/bid/30534/info Pcshey Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...