flatpress 0.909.1 - Stored XSS vulnerability

No description provided by source. Title: FlatPress 0.909.1 Stored XSS Vendor: http://www.flatpress.org Dork: powered by FlatPress AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

ASPNuke <= 0.80 (comment_post.asp) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w SQL Injection Exploit for ASPNuke = 0.80 This exploit retrieve the username of the administrator of the board and his password crypted in SHA256 Related advisory: http://www.securityfocus.com/archive/1/403479/30/0/threaded Discovered and Coded ...

Simple PHP Blog <= 0.4.0 - Remote Command Execution

No description provided by source. $Id: sphpblogfileupload.rb 9929 2010-07-25 21:37:54Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...

phpok存储型xss一枚

简要描述： rt 详细说明： PHPOK4.0.556 漏了评论处的 编码转换。 $content = $this-get"content",'html'; type为 html的话 case 'html':$msg = pregreplace$tmp,'',$msg;break; 只过滤了 $tmp = array"//isU","//isU","//isU","//isU","//isU","//isU","//isU","//isU"; 太弱。 审核评论 alert 可获取 浏览该商品的 用户的cookie 以及后台审核时 管理员的 cookie 漏洞证明：...

NIST Seeking Public Comment on SHA-3 Crypto Algorithm

The National Institute of Standards and Technology NIST is inviting the public to analyze and comment on its Secure Hash Algorithm-3 SHA-3, the latest iteration of cryptographic hash functions endorsed and published by the U.S. standards agency in order to protect the integrity of electronic...

Srun3000命令执行第5弹

简要描述： 第5弹 详细说明： 这回是post的命令执行而且需要注释掉后面的参数。 if $POST'act' == "auth" $command = "/srun3/radius/bin/radtest ".trim $POST'uname' ." ".trim $POST'pass' ." ".$array'serverip'." 10 ".$array'secret'; //后面注释掉就好 if $fp = popen $command, "r" //这里 $con = fread $fp, 10240 ; pclose $fp ; 漏洞证明：...

Vulnerability in Yahoo Websites Allows Hackers to Delete Any Comment

Two months ago, we reported a critical vulnerability on the Yahoo Answers platform that allowed a hacker to delete all the posted thread and comments from Yahoo's Suggestion Board website. Recently, a similar vulnerability has been reported by another Egyptian security researcher 'Ahmed Aboul-Ela...

Bugzilla 2.0 < 4.0.12 / 4.2.8 / 4.4.3 / 4.5.3 Character Spoofing

According to its banner, the version of Bugzilla installed on the remote host is after version 2.0 but prior to 4.0.12, 4.1.1 prior to 4.2.8, 4.3.1 prior to 4.4.3, or 4.5.1 prior to 4.5.3. It is, therefore, affected by a character spoofing vulnerability. The vulnerability exists in the bug commen...

CVE-2013-1407

Multiple cross-site scripting XSS vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 scope parameter to index.php; 2 username, 3 dbemphone, 4 useremail, or 5...

CVE-2012-6342

Cross-site request forgery CSRF vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment...

Vulnerability in PHPFox v3.7.3, v3.7.4 and v3.7.5 all build [ CVE-2013-7195, CVE-2013-7196 ]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CNA primary MITRE Corporation [email protected] Software Vendors PHPFox http://www.phpfox.com Product http://demo.phpfox.com Version: v3.7.3, v3.7.4 and v3.7.5 Research Wesley Henrique Leite wesleyhenrique NOSPAM gmail NOSPAM// com + INFORMATION...

NIST removes Dual EC DRBG from SP 800-90A

The maligned Dual EC DRBG random number generator at the core of a $10 million secret contract between RSA Security and the National Security Agency has been removed from NIST’s draft guidance on random number generators. The National Institute for Standards and Technology said it will request...

CVE-2013-7196

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

Design/Logic Flaw

static/ajax.php in PHPFox 3.7.3, 3.7.4, and 3.7.5 allows remote authenticated users to bypass intended "Only Me" restrictions and comment on a private publication via a request with a modified valitemid parameter for the publication...

CVE-2013-7196

PHPFox 3.7.3–3.7.5 contains a flaw in static/ajax.php that allows remote authenticated users to bypass the "Only Me" privacy setting and post a comment on private publications by manipulating the val[item_id] parameter. The root cause is insufficient access control in AJAX comment/like handling, ...

Slack: CSRF on add comment section

Hi, Steps to repro: 1 Go to this link https://sehacure.slack.com/help/requests/237956 2 The malicious guy should now the request number and the username. 3 Open Tamper data using tamper data firefox addon,Fill the reply in the form. 4 Submit the request.You will see there are no anti-csrf token i...

Joomla! JV Comment扩展'id'参数SQL注入漏洞

BUGTRAQ ID: 64661 CVECAN ID: CVE-2014-0794 JV Comment是Joomla!的一个扩展，可以将评论系统添加到文章内。 JV Comment for Joomla!版本3.0.2，文件comjvcomment在实现上存在跨站脚本漏洞，这可使远程攻击者在comment.like操作的id参数，利用此漏洞注入任意Web脚本或HTML，从而查看、添加、修改、删除后端数据库内的信息。 0 Joomla! JV Comment 3.0.2 厂商补丁： Joomla! ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

SA-CONTRIB-2014-010 - Services - Access Bypass and Privilege Escalation

The Services module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. User update access bypass vulnerability An authenticated user is able to assign additional roles to themselves, which means they can escalate their privileges by assigning an...

CVE-2014-0793

Multiple cross-site scripting XSS vulnerabilities in the StackIdeas Komento comkomento component before 1.7.3 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 website or 2 latitude parameter in a comment to the default URI...

Sql injection

SQL injection vulnerability in the JV Comment comjvcomment component before 3.0.3 for Joomla! allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a comment.like action to index.php...