Unfixed XSS vulnerability at www.cappa27.com

Security researcher Atmon3r, has submitted on 14/01/2012 a cross-site-scripting XSS vulnerability affecting www.cappa27.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/01/2012. It is currently...

Look411.com Cross Site Scripting

WhiteHatZone Vulnerable : http://www.look411.com/ Script : alert'XSS found by Girish Shrimali'; Vulnerable link : http://www.look411.com/?p=numbersearch&q=%3Cscript%3Ealert%28%27XSS+found+by+Girish+Shrimali%27%29%3B%3C%2Fscript%3E&country=US Greetz : Vidit Baxi, Sumit Pareek...

One million pages infected by Lilupophilupop SQL injection

One million pages infected by Lilupophilupop SQL injection ISC Internet Storm Center reported that lilupophilupop.com SQL injection attacks. There were about 80 pages infected according to Google searches few weeks back and now it raise to over 1 million . sites being injected with string :...

PT-2011-5159

Name of the Vulnerable Software and Affected Versions com fabrik versions prior to 2.1.1 Description The issue allows remote authenticated users with Manager privileges to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file i...

Unfixed XSS vulnerability at busca.r7.com

Security researcher NetFuzzer, has submitted on 22/12/2011 a cross-site-scripting XSS vulnerability affecting busca.r7.com, which at the time of submission ranked 1011 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is currently...

Adobe Shockwave NPAPI Plug-in Drag and Drop Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the NPAPI version of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fla...

PT-2011-5123

Name of the Vulnerable Software and Affected Versions com vikrealestate version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the contract parameter in a results action and the imm parameter in a show action to "index.php"...

PT-2011-5130

Name of the Vulnerable Software and Affected Versions Barter Sites component version 1.3 for Joomla! Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several parameters, including listing title, description, homeurl, paystring, sell price, shippin...

PT-2011-5115

Name of the Vulnerable Software and Affected Versions Joomla! component com hmcommunity version prior to 1.01 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in a save task for a profile to "index.php". The vulnerable parameters include...

Unfixed XSS vulnerability at www.56770.com

Security researcher p0pc0rn, has submitted on 14/12/2011 a cross-site-scripting XSS vulnerability affecting www.56770.com, which at the time of submission ranked 459802 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2011. It is currently...

PT-2011-5110

Name of the Vulnerable Software and Affected Versions Joomla! com obsuggest component versions prior to 1.8 Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by utilizing a .. dot dot in the controller parameter to "index.php". Recommendations For...

PT-2011-5114

Name of the Vulnerable Software and Affected Versions Joomla! component com hmcommunity version prior to 1.01 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in a 'fnd home' action to 'index.php'. Recommendations For...

PT-2011-4998

Name of the Vulnerable Software and Affected Versions Joomla! component Time Returns com timereturns versions 2.0 and possibly earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in a timereturns action to...

PT-2011-1988

Name of the Vulnerable Software and Affected Versions Joomla! component com xobbix version 1.0.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the prodid parameter in a prod desc action to "index.php". Recommendations For version 1.0.1, avoi...

PT-2011-1983

Name of the Vulnerable Software and Affected Versions JComments com jcomments component version 2.1.0.0 for Joomla! Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to...

PT-2011-1967

Name of the Vulnerable Software and Affected Versions Joomla! component com bfquiztrial versions prior to 1.3.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the catid parameter in a bfquiztrial action to "index.php". Recommendations For...

PT-2011-1979

Name of the Vulnerable Software and Affected Versions Joomla! component com searchlog version 3.1.0 Description The issue allows remote authenticated users with Public Back-end privileges to execute arbitrary SQL commands. This is achieved by exploiting the search parameter in a log action to the...

PT-2011-1963

Name of the Vulnerable Software and Affected Versions JExtensions JE Job com jejob component version 1.0 for Joomla! Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the catid parameter in an item action to "index.php". Recommendation...

PT-2011-1925

Name of the Vulnerable Software and Affected Versions Joomla! component com addressbook affected versions not specified Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the Itemid parameter in a contact action to the...

PT-2011-1903

Name of the Vulnerable Software and Affected Versions com wmtpic version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the Itemid parameter in the "/index.php" API endpoint. Recommendations For version 1.0, avoid using the Item...