Commentics 2.0 - Multiple Vulnerabilities

Commentics 2.0 Vendor information: "Commentics is a free, advanced PHP comment script with many features. Professionally written and with open source code, its main aims are to be integrable, customizable and secure." Vendor URI: http://www.commentics.org/ Issues: Cross Site Scripting, Cross Site...

WordPress Comment Extra Fields Shell Upload

Description : Wordpress Plugins - Comment Extra Fields Shell Upload Vulnerability Version : 1.7 Link : http://wordpress.org/extend/plugins/comment-extra-field/ Plugins : http://downloads.wordpress.org/plugin/comment-extra-field.1.7.zip Date : 30-05-2012 Google Dork :...

Wordpress Plugins - Comment Extra Fields Shell Upload Vulnerability

Exploit for php platform in category web applications Description : Wordpress Plugins - Comment Extra Fields Shell Upload Vulnerability Version : 1.7 Link : http://wordpress.org/extend/plugins/comment-extra-field/ Plugins : http://downloads.wordpress.org/plugin/comment-extra-field.1.7.zip Date :...

Chrome 18 Anti-XSS Bypass

Exploit Title: Chrome 18 anti-XSS bypass Date: 2012-05-31 Author: k3170makan Vendor or Software Link: download link if available Version: 18.0.1025.162 Category:: local Google dork: N/A Tested on: Ubuntu 10.04 Demo site: N/A Chrome 18---and possibly 19--- versions anti-XSS filter or XSSAuditor as...

SA-CONTRIB-2012-087 - Comment Moderation - Cross Site Request Forgery

This module enables you to moderate comments in an accelerated way, by providing a complete interface and all useful actions in a unique page. The module doesn't sufficiently protect the publish link URL, thus a Cross Site Request Forgery CSRF attack against an administrator could result in...

NewsAdd <=1.0 Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: NewsAdd =1.0 Multiple SQL Injection Google Dork: ----------------------------------- Date: 2012/05/29 Author: WhiteCollarGroup Software Link: http://phpbrasil.com/script/3tCyUs1JeL1M/newsadd--mysql Version: 1.0 Tested on: Debian...

Wordpress 3D cubes Theme XSS Vulnerability

Exploit for php platform in category web applications +-----------------------------------------------------------+ Exploit Title : Title: XSS Vulnerability In Wordpress 3D cubes Theme Software Link : http://test.qualitywordpress.com/wp-content/themes/3dcubes/images/download.zip Date : 27/05/2012...

CVE-2011-5090

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

Authentication flaw

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

WikkaWiki 1.3.2 Spam Logging PHP Injection

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

Facebook Anti-Troll System Snagging Ordinary Users

Complaints rang far and wide last week after an automated system for spotting inappropriate Facebook comments began blocking legitimate posts by the social network’s users, including prominent members like Robert Scoble. Facebook users of all stripes have received warnings about posting...

SDCMS 1. 1sp1 the XSS vulnerability of the mining and use-vulnerability and early warning-the black bar safety net

SDCMS 1. 1sp1XSSthe vulnerability of the mining and use of SDCMS name: era website Information Management System. SDCMS is based on ASP+ACCESS/MSSQL website Information Management System. Permanently free, open source! SDCMS to information as the theme, through text and image title as a starting...

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities

WordPress 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-20...

deletion of a comment with a security setting sends a notification to all watchers and the history tab

As a non-atlassian developer, I saw a deletion notification for a comment that I was restricted from viewing. That seems like a security leak. It would be annoying if we're trying to hide discussion from certain users for them to see that the discussion is happening at all, it would raise questio...

deletion of a comment with a security setting sends a notification to all watchers and the history tab

As a non-atlassian developer, I saw a deletion notification for a comment that I was restricted from viewing. That seems like a security leak. It would be annoying if we're trying to hide discussion from certain users for them to see that the discussion is happening at all, it would raise questio...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities

Title: ====== Flatnux CMS 2011 08.09.2 - Multiple Web Vulnerabilities Date: ===== 2012-04-01 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=487 VL-ID: ===== 487 Introduction: ============= Flatnux is no database CMS for accessible websites, corporate websites, e-commer...

DEBIAN-CVE-2012-2054

Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the 1 Comment, 2 Document, 3 IssueCategory, 4 MembersController, 5 Message, 6 News, 7 TimeEntry, 8 Version, 9 Wiki, 10 UserPreference, o...

PlumeCMS <= 1.2.4 Multiple Persistent XSS

Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano Binetti...