4Site CMS 2.6 SQL Injection

WSEC-09-002 4Site CMS = 2.6 Multiple Remote SQL Injections Developer site: http://www.4site.ru/ Discovered by D.Mortalov // wsec.ru 1. Auth Bypass Login: 1'or'1 Password: 1'or’1 2. Multiple Remote SQL Injections in 4site CMS modules "Pages" module:...

XSS in the Widget Connector

I've been working with the widget connector today and reading through the code when I noticed that the media uris are not being handled securely. try this: widget:url=youtube.com/v="alert'xss' In general there is not a unified way to prevent issues like this in the widget extensions and it is up ...

XSS in the Widget Connector

I've been working with the widget connector today and reading through the code when I noticed that the media uris are not being handled securely. try this: widget:url=youtube.com/v="alert'xss' In general there is not a unified way to prevent issues like this in the widget extensions and it is up ...

JVN#72630020 MODx vulnerable to SQL injection

MODx, an open source contents management system, contains a SQL injection vulnerability in the MODx Control Panel. Impact A remote attacker could obtain administrative privileges of MODx. Solution Update the Software Apply the latest update provided by the developer. Products Affected MODx 0.9.6....

JVN#10170564 MODx cross-site scripting vulnerability

MODx, an open source contents management system, contains multiple cross-site scripting vulnerabilities. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the latest update provided by the developer. Products Affected MODx 0.9.6.2 and earlier...

ILIAS 3.7.4 - ref_id Blind SQL Injection

ILIAS 3.7.4 - refid Blind SQL Injection ILIAS Learning Management 50-- milw0rm.com 2008-12-24...

ILIAS <= 3.7.4 (ref_id) Blind SQL Injection Vulnerability

No description provided by source. ILIAS Learning Management = 3.7.4 - SQL Injection Vulnerability Vulnerability discovered by: LidlosesAuge Greetz to: -=Player=- , Suicide, g4ms3, enco, Palme, GPM, karamble, Free-Hack Date: 24.12.2008 Developer: http://www.ilias.de Dork 1: "powered by ILIAS" Dor...

ILIAS <= 3.7.4 (ref_id) Blind SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================= ILIAS 50-- 0day.today 2018-03-20...

JVN#50327700 PHP vulnerable to cross-site scripting

PHP is an open source scripting language that is especially suited for Web development. PHP contains a cross-site scripting vulnerability as it does not properly handle errors. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the latest upda...

JVN#20502807 Snoopy command injection vulnerability

Snoopy is an open source PHP library. Snoopy does not properly handle user-input data. This causes a vulnerability which may allow a remote attacker to execute an arbitrary command. Impact An arbitrary command could be executed with the privilege of the server where Snoopy runs. Solution Update t...

JVN#03300113 Blosxom vulnerable to cross-site scripting

Blosxom is an open source weblog system. Blosxom contains a cross-site scripting vulnerability. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest udpate provided by the developer. Products Affected Blosxom 2.1.1 and earlier...

CVE-2008-2619

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2, allows remote authenticated users to affect availability via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2, allows remote authenticated users to affect availability via unknown vectors...

CVE-2008-2619

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2, allows remote authenticated users to affect availability via unknown vectors...

CVE-2008-2619

The CVE-2008-2619 entry describes an unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server (versions 1.0.2.2, 9.0.4.3, 10.1.2.2) and E-Business Suite 11.5.10.2. It allows remote authenticated users to affect availability via unknown vectors. The connecte...

CVE-2008-2619: Undefined Security Weakness

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Application Server 1.0.2.2, 9.0.4.3, and 10.1.2.2, and E-Business Suite 11.5.10.2, allows remote authenticated users to affect availability via unknown vectors...

JVN#92651529 Nucleus EUC-JP Japanese Edition vulnerable to cross-site scripting

Nucleus is an open source content management system provided by The Nucleus Group. Nucleus EUC-JP Japanese Edition contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the specific web browser. Solution Update the Software Apply the latest update provided b...

JVN#79026329 Kantan WEB Server directory traversal vulnerability

Kantan WEB Server is a web server for Windows provided by Arihiro Kurata. Kantan WEB Server contains a directory traversal vulnerability. Impact A remote attacker could view or obtain files on the server where Kantan WEB Server is installed. Solution Update the Software Apply the latest update...

JVN#94163107 Kantan WEB Server cross-site scripting vulnerability

Kantan WEB Server is a web server for Windows provided by Arihiro Kurata. Kantan WEB Server contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Apply the latest update provided by the developer. Products...

claroline18x-rfi.txt

Claroline 1.8.x Remote File Inclusion Vulnerability By: e.wiZz! Info: Bosnian Idiot FTW! :D ------------cut here------------------- In the wild.... Script: claroline.net Info: Claroline is an Open Source eLearning and eWorking platform allowing teachers to build effective online courses and to...