93 matches found
CVE-2019-11447
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...
Mail.ru: XSS on account.mail.ru/login
Уязвимость на станице https://account.mail.ru/login и подготовка файлов для атаки --------------------- В процессе исследования заметил, что на странице https://account.mail.ru/login не валидируется значение параметра v. Значение выводится на странице как есть и используется в пути до скрипта...
WordPress AnyVar Plugin Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed using the PHP language.REST API can transfer data via JSON format to access or control the content of the WordPress site. A cross-site scripting vulnerability exists in the WordPress AnyVar plugin. An attacker can use the vulnerability to execute arbitra...
nagios: Command injection via curl in MagpieRSS
It was found that an attacker who could control the content of an RSS feed could execute code remotely using the Nagios web interface. This flaw could be used to gain access to the remote system and in some scenarios control over the system...
Slack: Subdomain takeover on podcasts.slack-core.com
I noticed slack-core.com is used for Slack's call infrastructure. I had never seen that domain before, so I decided to find out what else was running on it. It turned out podcasts.slack-core.com was pointing to a Podcast and RSS hosting service called Feed.Press. However, there was no Feed.Press...
Ganglia Web Frontend 3.5.1 - PHP Code Execution
Ganglia Web Frontend 3.5.1 - PHP Code Execution...
CreA8social 'Add Game' Field HTML Injection Vulnerability
CreA8social is a social networking platform. An HTML injection vulnerability exists in the CreA8social 'Add Game' field, where attacker-supplied HTML or JavaScript code can run on the affected site. This allows an attacker to steal cookie-based authentication credentials and control the content...
Microsoft Windows - Print Spooler Service Impersonation (MS10-061) (Metasploit)
$Id: ms10061spoolss.rb 11766 2011-02-17 19:22:11Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...
Fedora Update for drupal-views FEDORA-2010-19009
Check for the Version of drupal-views OpenVAS Vulnerability Test Fedora Update for drupal-views FEDORA-2010-19009 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
[SECURITY] Fedora 12 Update: drupal-views-6.x.2.11-1.fc12
The views module provides a flexible method for Drupal site designers to control how lists of content nodes are presented. Traditionally, Drupal has hard-coded most of this, particularly in how taxonomy and tracker lists are formatted. This tool is essentially a smart query builder that, given...
Outpost Security Suite Pro ver. 2009 Multiple vulnerabilities
Application: Outpost Security Suite Pro ver. 2009 OS: Windows Xp All patches a day ------------------------------------------------------ 1 - Description 2 - Vulnerability 3 - POC/EXPLOIT ------------------------------------------------------ Description Outpost Security Suite is a software...
getinternet.txt
CRIOLABS - Software: getInternet - Type: E-business:Internet - Company: getSolutions - Date: 09-9-2004 Software: getInternet Platform: ASP, Microsoft SQL Comments: Administration section Not Tested Description getInternet will allow you to maintain, manage and control all of the content on your...
