Persistent Systems Client Automation - Command Injection Remote Code Execution (Metasploit)

Exploit Title: Persistent Systems Client Automation PSCA, formerly HPCA or Radia Command Injection Remote Code Execution Vulnerability Date: 2014-10-01 Exploit Author: Ben Turner Vendor Homepage: Previosuly HP, now http://www.persistentsys.com/ Version: 7.9, 8.1, 9.0, 9.1 Tested on: Windows XP,...

Apple OS X Yosemite system exposure more local to mention the right vulnerability-vulnerability warning-the black bar safety net

Foreign security researchers have recently exposed the latest version of Mac OSX 10.10.1 system on the presence of multiple local mention the right vulnerability, due to the submitted to Apple the official time for too long are not get a clear answer, leading the researcher directly to the...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

PT-2015-4248

Name of the Vulnerable Software and Affected Versions Moip module versions prior to 7.x-1.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback. Recommendations For Moip module versio...

CVE-2014-9500: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

MODX Revolution-pl Cross-Site Scripting Vulnerability

MODX Revolution is a content management system that claims to be the most flexible and open and free. A cross-site scripting vulnerability exists in MODX Revolution 2.3.2-pl, which allows remote attackers to inject arbitrary web script or HTML via callback parameters...

CVE-2014-8992

Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

PT-2014-8772

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.3.2-pl Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the callback parameter in the manager/assets/fileapi/FileAPI.flash.image.swf file...

CVE-2014-8992: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

WS-2014-0038

“JMXJSONServlet” in Apache Hadoop versions 2.4.0 to 2.6.5 are vulnerable to XSS by passing a callback parameter in the JMX response...

PT-2020-7585 · Dbi +3 · Dbi +3

Name of the Vulnerable Software and Affected Versions: DBI module versions prior to 1.632 for Perl Description: An issue in the DBI module for Perl may lead to memory corruption when using many arguments to methods for Callbacks. Recommendations: For versions prior to 1.632, update to version 1.6...

CVE-2014-9153

Cross-site scripting XSS vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

CVE-2014-9153: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

PT-2014-8853

Name of the Vulnerable Software and Affected Versions Drupal Services module versions 7.x-3.x before 7.x-3.10 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

OracleVM 2.1 : kernel (OVMSA-2009-0014)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-1192 The 1 agpgenericallocpage and 2 agpgenericallocpages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later...

Immunity Canvas: MS14_064_IE_OLEAUT32

Name| ms14064ieoleaut32 ---|--- CVE| CVE-2014-6332 Exploit Pack| CANVAS Description| MS14064 - Windows OLE Automation Array Remote Code Execution Vulnerability Notes| CVE Name: CVE-2014-6332 VENDOR: Microsoft NOTES: References:...

TinyShop SQL注入一枚

简要描述： 20140926 详细说明： 这次这个还是在payment里，是异步callback时候，有类似问题，其实我不想分开交的，其实不想分开交，怕有重复过不了。 /protected/controllers/payment.php中 asynccallback function asynccallback //从URL中获取支付方式 $paymentid = Filter::intReq::get'paymentid'; $payment = new Payment$paymentid; $paymentPlugin = $payment-getPaymentPlugin;...

TinyShop SQL注入一枚

简要描述： 20140926 详细说明： /protected/controllers/payment.php中 callback 函数 public function callback //从URL中获取支付方式 $paymentid = Filter::intReq::get'paymentid'; $payment = new Payment$paymentid; $paymentPlugin = $payment-getPaymentPlugin; //先获取一个支付方式，默认只有余额支付 ，id为1 。。。 //执行接口回调函数 $callbackData =...