Netin(Knight)content management system vulnerability-vulnerability warning-the black bar safety net

A very cold content management system, for the first time. Background path: netin/Login. asp Default user: admin/netin The default password is:0 0 0 0 0 0/netin2009 Default database:db$snetinb\db$snetin. mdb The default administrator table: BsUser Injection point: http://0day5.com/shownews.asp?id...

Zend-Framework - Full Information Disclosure

Zend-Framework - Full Information Disclosure Exploit Title : Zend-Framework Full Info Disclosure Google Dork : inurl:/application/configs/application.ini Date : 26/11/2013 Exploit Author : Ariel Orellana Vendor Homepage : http://framework.zend.com/ Category : Web applications Tested on : GNU/Linu...

SAP Sybase Adaptive Server Enterprise Information Disclosure (SAP Note 1893562)

Information about SAP Sybase ASE may be discovered in database dump files. This information may be used by an attacker to create targeted attacks against SAP Sybase ASE. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70980; scriptversion"1.9";...

Microweber 0.905 SQL Injection

=============================================================================== | | / / / / / / // / / -/ - / // / / / / // / ////,//////,// ///, / // team PUBLIC SECURITY ADVISORY | | =============================================================================== TITLE ===== Microweber...

CVE-2013-3279

EMC Atmos before 2.1.4 uses a default/blank PostgreSQL password, allowing remote attackers to connect to the database server and obtain sensitive administrative information. Affected: Atmos software on all supported hardware/VE prior to 2.1.4. Root cause: unauthenticated access due to no password...

CVE-2013-5208

CVE-2013-5208 affects HR Systems Strategies info:HR HRIS 7.9, where the database password is stored in a registry key (USERPW) with weak obfuscation. This enables a local attacker to read/decipher the password and gain full control of the database and application, including access to PII. Vendor ...

mod_accounting Module 0.5 - Blind SQL Injection

modaccounting Module 0.5 - Blind SQL Injection - Affected Vendor: http://sourceforge.net/projects/mod-acct/files/ - Affected Software: modaccounting - Affected Version: 0.5. Other earlier versions may be affected. - Issue type: Blind SQL injection - Release Date: 20 Sep 2013 - Discovered by: Elda...

Woltlab Burning Board FLVideo Addon SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Woltlab Burning Board FLVideo Addon SQL Injection flvideo.php Exploit Google Dork: inurl:flvideo.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Vendor Homepage: http://www.flvideo.de/ Version: FLVideo Addon for WB...

v5shop官方数据库存在弱口令可获取库内全部数据

简要描述： 首先说明！从头到尾没有拿过shell！我也没有shell 今天上乌云看看有啥漏洞，结过看到20天没审核的V5shop审核了，还给了好多rank。 就看了看，骗rank啦，，，v5shop也不是小厂商的说。 详细说明： 好吧，手贱看看目录吧！ dedecms的好像，，，没别的漏洞！ 看看/phpMyAdmin/ 尼玛！猜中了。。。 http://www.v5shop.com.cn/phpMyAdmin/ 好吧，用v5shop，v5shop试试，（麻烦审核后打码哦！） 好鸟。。。。 看看自评20rank会给多少啊! 漏洞证明： 上图，不说了！ 自己test去吧。。...

CVE-2013-0148

The CVE-2013-0148 issue affects FairCom c-treeACE’s Data Camouflage (formerly FairCom Standard Encryption). The vulnerability is that the decryption key is not required to access database contents, allowing an attacker to read cleartext records by copying a database to another system configured w...

PHP Address Book - addressbookregisterdelete_user.php?id SQL Injection

PHP Address Book - addressbookregisterdeleteuser.php?id SQL Injection source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker ...

PHP Address Book - '/addressbook/register/edit_user.php?id' SQL Injection

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

Sparx Systems Enterprise Architect 9.3.931 Corporate Password Disclosure

Subject ======= Simple password obfuscation in Sparx Systems "Enterprise Architect" when using server based repositories Affected product ================ Product: Enterprise Architect Vendor: Sparx Systems Affected versions ================= Tested with 9.3.931 Corporate, other versions likely t...

SAP NetWeaver ABAD0_DELETE_DERIVATION_TABLE - SQL Injection

Application: SAP NetWeaver Versions Affected: 7.30 Basis 720 SP 0, Kernel 720 patch 68 Vendor URL: http://www.sap.com Bugs: SQL injection Exploits: NO Reported: 25.01.2013 Vendor response: 26.01.2013 Date of Public Advisory: 30.08.2013 Reference: SAP Security Note 1840249 Author: Nikolay Mescheri...

Scripts Genie Classified Ultra - SQL Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/57465/info Classified Ultra is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal cookie-based...

MySQL FILE privilege elevation

Added: 12/21/2012 CVE: CVE-2012-5613 BID: 56771 OSVDB: 88118 Background MySQL is an open-source database software package available for multiple platforms. Problem A database user who has FILE permission can write arbitrary files to the file system, leading to privilege elevation. Resolution Revo...

Encrypt Database Password in dbconfig.xml or use integrated authentication

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-31004. panel panel:title=Atlassian Update – 5 January 2016|borderStyle=solid|borderColor=ebf2f9 | titleBGColor=ebf2f9 | bgColor=ffffff Hi...

Svlink SQL Injection Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

SVN wc.db Scanner

Scan for servers that allow access to the SVN wc.db file. Based on the work by Tim Meddin. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SVN wc.db Scanner', 'Description' = %q Scan for server...