FreeBSD : codeigniter -- multiple XSS vulnerabilities (95602550-76cf-11e5-a2a1-002590263bf5)

The CodeIgniter changelog reports : Fixed a number of XSS attack vectors in Security Library method xssclean thanks to Frans Rosen from Detectify. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

Multiple XSS Filter Bypasses

Overview Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the denylist-based filter. Proof of Concept Various inputs that could bypass the filter were discovered: Improper parsing of nested tags: This is a test...

codeigniter -- multiple XSS vulnerabilities

The CodeIgniter changelog reports: Fixed a number of XSS attack vectors in Security Library method xssclean thanks to Frans Rosén from Detectify...

FreeBSD : codeigniter -- multiple vulnerabilities (c21f4e61-6570-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : Security: Added HTTP 'Host' header character validation to prevent cache poisoning attacks when baseurl auto-detection is used. Security: Added FSCommand and seekSegmentTime to the 'evil attributes' list in CISecurity::xssclean. %NASLMINLEVEL 70300 C Tenable...

FreeBSD : codeigniter -- SQL injection vulnerability (b7d785ea-656d-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection. An incompatibility in PHP versions 5.0.7 with mysqlsetcharset creates a...

FreeBSD : codeigniter -- multiple vulnerabilities (f838dcb4-656f-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : Security: The xorencode method in the Encrypt Class has been removed. The Encrypt Class now requires the Mcrypt extension to be installed. Security: The Session Library now uses HMAC authentication instead of a simple MD5 checksum. %NASLMINLEVEL 70300 C Tenable...

FreeBSD : codeigniter -- mysql database driver vulnerability (01bce4c6-6571-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : Security: Removed a fallback to mysqlescapestring in the mysql database driver escapestr method when there's no active database connection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

FreeBSD : codeigniter -- SQL injection vulnerability (5114cd11-6571-11e5-9909-002590263bf5)

The CodeIgniter changelog reports : Security: Fixed a SQL injection vulnerability in Active Record method offset. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacque...

codeigniter -- SQL injection vulnerability

The CodeIgniter changelog reports: Security: Fixed an SQL injection vulnerability in Active Record method offset...

Critical SQL injection bug in the ODBC database driver

More info at https://forum.codeigniter.com/thread-65803.html...

codeigniter -- mysql database driver vulnerability

The CodeIgniter changelog reports: Security: Removed a fallback to mysqlescapestring in the mysql database driver escapestr method when there's no active database connection...

Nakid CMS Cross-Site Request Forgery Vulnerability

Nakid CMS is an open source content management system CMS based on PHP and CodeIgniter. Nakid CMS suffers from a cross-site request forgery vulnerability. The vulnerability allows attackers to perform unauthorized operations...

Nakid CMS Local File Inclusion Vulnerability

Nakid CMS is an open source content management system CMS based on PHP and CodeIgniter. Nakid CMS suffers from a local file inclusion vulnerability that allows an attacker to read arbitrary files...

Nakid-CMS CSRF, Persistent XSS & LFI

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NAKIDCMS0611.txt Vendor: ================================ http://kilrizzy.github.io/Nakid-CMS/ Product: ================================ kilrizzy-Nakid-CMS-f274624 Nakid CMS is...

Nakid CMS - Multiple Vulnerabilities

Nakid CMS - Multiple Vulnerabilities Exploit Title: CSRF, Persistent XSS & LFI Google Dork: intitle: CSRF, Persistent XSS & LFI Date: 2015-06-11 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: kilrizzy.github.io/Nakid-CMS Software Link:...

Nakid CMS CSRF / XSS / Local File Inclusion

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NAKIDCMS0611.txt Vendor: ================================ http://kilrizzy.github.io/Nakid-CMS/ Product: ================================ kilrizzy-Nakid-CMS-f274624 Nakid CMS is...

Nakid CMS - Multiple Vulnerabilities

Exploit Title: CSRF, Persistent XSS & LFI Google Dork: intitle: CSRF, Persistent XSS & LFI Date: 2015-06-11 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: kilrizzy.github.io/Nakid-CMS Software Link: kilrizzy.github.io/Nakid-CMS Version:...

Nakid CMS CSRF / XSS / Local File Inclusion Vulnerability

Nakid CMS suffers from cross site request forgery, cross site scripting, and local file inclusion vulnerabilities. + Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NAKIDCMS0611.txt Vendor: ================================...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when baseurl auto-detection is used. Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CISecurity::xssclean...

Seagate Business NAS - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class MetasploitModule 'Seagate Business NAS Unauthenticated Remote Command Execution', 'Description' = %q Some Seagate Busine...