Joomla com_blog_calendar Module SQL Injection Vulnerability

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A SQL injection vulnerability exists in the Joomla comblogcalendar module. An attacker can manipulate the modid value to execute SQL commands and re...

trainerize.com XSS vulnerability

Open Bug Bounty ID: OBB-198908 Description| Value ---|--- Affected Website:| trainerize.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Shopify: Stored XSS in blog comments through Shopify API

Hi there! As far I understand the Shopify Shop have blogs which allow users to comment on blog posts, however the comments with HTML content automatically gets sanitised and then posted to avoid XSS issue. However using the API for comment modification, any application with comment permission can...

Emlog personal blog system exists arbitrary file deletion vulnerability

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. The /src/admin/data.php page of the emlog personal blog system has an arbitrary file deletion vulnerability. As Bak fails to bring in the unlink function directly after the restriction, allowing an attacker to delete...

Netcore Netis Routers - UDP Backdoor Access

Netcore Netis Routers - UDP Backdoor Access !/usr/bin/python -- coding: utf8 -- NETCORE / NETDIS UDP 53413 BACKDOOR https://netisscan.shadowserver.org/ http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/ https://www.seebug.org/vuldb/ssvid-90227 impor...

Microsoft Internet Explorer 8 MSHTML Ptls5::LsFindSpanVisualBoundaries Memory Corruption

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the fifteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

LEPTON 2.2.2 - Remote Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version Link: http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php Vendor Website: http://www.lepton-cms.org/ Vulnerability Type: Code Execution Remote Exploitable: Yes...

Jaws 1.1.1 Open Redirect / Object Injection / Cookie Flags Vulnerabilities

Jaws version 1.1.1 suffers from object injection, open redirection, and cookie flag related vulnerabilities. 1. Introduction Affected Product: Jaws 1.1.1 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://jaws-project.com/ Vulnerability Type: Object Injection, Open Redirect, Cooki...

Avast Premier Sandbox Escape Security Bypass Vulnerability

Avast Premier is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:avast:avastpremier";...

DCFM Blog 0.9.7 Blind SQL Injection Vulnerability

DCFM Blog version 0.9.7 suffers from a remote blind SQL injection vulnerability. DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Description ============ Open-source blog project. Free blo...

DCFM Blog 0.9.7 Cross Site Scripting Vulnerability

DCFM Blog version 0.9.7 suffers from a cross site scripting vulnerability. DCFM Blog 0.9.7 XSS Attack =========================== Description ============ Open-source blog project. Free blog system for any website. Uses MySQL and PHP 5. Very easily customizable and incredibly flexible...

DCFM Blog 0.9.7 Cross Site Scripting

DCFM Blog 0.9.7 XSS Attack =========================== Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog system for any website. Uses MySQL and PHP 5. Very easily customizable and incredibly flexible...

DCFM Blog 0.9.7 Blind SQL Injection

DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog...

No payment necessary: Fighting back against ransomware

Note: Read our latest comprehensive report on ransomware: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene. Any IT professional who’s ever had an experience with malware knows how fast an intrusive attack can happen, and how difficult it can be to educate...

merkleinc.com XSS vulnerability

Vulnerable URL: https://www.merkleinc.com/blog/marketing-solutions-and-strategies/marketing-technology?page=1" Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 22:46 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

FedRAMP Plans for 2017

The Federal Risk and Authorization Management Program FedRAMP plans to continue to build on 2016 successes by planning for an ambitious 2017 according to a series of blog posts released by the General Services Administration GSA...

PT-2016-7716

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.10.5 Description The issue allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with a zip extension. This can be achieved through the "Install or upgrade manually"...

CVE-2016-9268: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

Simple PHP Blog Cross-Site Scripting Vulnerability

Simple PHP Blog is an open source free single-user Blog program written in PHP. A cross-site scripting vulnerability exists in the q parameter of the search.php page in Simple PHP Blog version 0.4.0 due to the program failing to adequately filter user-submitted input. An attacker can exploit this...

Simple PHP Blog 0.4.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications + Credits: Boumediene KADDOUR AKA sh311c0d3r + Website: http://www.pentestingskills.com Vendor: ====================== http://www.simpleblogphp.com Product: =============================== Simple PHP Blog 0.4.0 Vulnerability Type:...