259 matches found
CVE-2007-6597
Multiple cross-site scripting XSS vulnerabilities in IPortalX before Build 033 allow remote attackers to inject arbitrary web script or HTML via the 1 KW and 2 SF parameters to forum/loginuser.asp, and 3 the Date parameter to blogs.asp...
PT-2007-7428 · Iportalx · Iportalx
Name of the Vulnerable Software and Affected Versions: IPortalX versions prior to Build 033 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include...
Unfixed XSS vulnerability at scienceblogs.com
Security researcher tenest, has submitted on 12/11/2007 a cross-site-scripting XSS vulnerability affecting scienceblogs.com, which at the time of submission ranked 11754 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/11/2007. It is currentl...
openSUSE 10 Security Update : moodle (moodle-3959)
This update fixes the following issues : - possible remote file inclusion CVE-2007-1429 - XSS injection in SCORM 1.2 reports - Fixed XSS in login block Additionally changes : - Fixed visibility of site blogs - moodle-config.php is now located in /etc/moodle/ - added safemode and session.savehandl...
Wordpress Multiple Versions Pwnpress Exploitation Tookit (0.2pub)
Exploit for unknown platform in category web applications ================================================================= Wordpress Multiple Versions Pwnpress Exploitation Tookit 0.2pub ================================================================= !/usr/bin/env ruby .---. .---. : : o : happ...
PHPBlogger is a simple tool to help the creation of web blogs... Encrypted admin password and other preferences are stored on /data/pref.db You can find lots of them exposed with google search: pref password= filetype:db = -------------------------------------------- The admin panel is acessible...
PHPBlogger cookie privilege escalation
PHPBlogger is a simple tool to help the creation of web blogs... Encrypted admin password and other preferences are stored on /data/pref.db You can find lots of them exposed with google search: pref password= filetype:db = -------------------------------------------- The admin panel is acessible...
CVE-2007-4047
geoBlog aka BitDamaged 1 does not require authentication for 1 deletecomment.php, 2 deleteblog.php, and 3 listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter...
Authentication flaw
geoBlog aka BitDamaged 1 does not require authentication for 1 deletecomment.php, 2 deleteblog.php, and 3 listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter...
blogsite-sql.txt
--==+================================================================================+==-- --==+ BlogSite Professional SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK:...
GeoBlog MOD_1.0 - deletecomment.php?id Arbitrary Comment Deletion
GeoBlog MOD1.0 - deletecomment.php?id Arbitrary Comment Deletion source: https://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploi...
GeoBlog MOD_1.0 - 'deleteblog.php?id' Arbitrary Blog Deletion
source: https://www.securityfocus.com/bid/24966/info geoBlog is prone to multiple security-bypass vulnerabilities because the application fails to properly validate users when deleting user blogs and comments. An attacker may exploit these issues to delete blogs and comments regardless of the...
Geoblog v1 administrator bypass
Geoblog v1. A vulnerability exists in geoblog version 1 latest that allows users to delete other peoples comments without administration credentials. It works on blogs too. Users can delete blogs without user credentials. The reason why is because the listcomments.php and deletecomments.php files...
Apple Safari 2.0.4 - Cross-Domain Browser Location Information Disclosure
source: https://www.securityfocus.com/bid/24121/info Apple Safari is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain JavaScript restrictions. Exploiting this issue may allow attackers to access locations that a user visits, even if it's in a...
CVE-2007-2681
Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...
CVE-2006-6925
Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...
CVE-2006-6924
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...
Microsoft Word 0-day Vulnerability (September) FAQ document available
New FAQ document about the recently discovered 0-day vulnerability in Microsoft Word is available. This vulnerability has been reported especially in Office 2000 on Windows 2000 machines. Possible other Office versions are affected as well. This vulnerability is being exploited by Trojan from...
[Full-disclosure] Microsoft PowerPoint 0-day Vulnerability FAQ document written
I have written FAQ document including 33 items about the recently reported 0-day vulnerability in PowerPoint. This vulnerability is being exploited by Trojan horse including keylogger features. The document entitled as Microsoft PowerPoint 0-day Vulnerability FAQ is located at my SecuriTeam Blogs...