CVE-2008-3879

The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destinati...

rmsoft-xss.txt

RMSOFT Downloads Plus two scripts two variables XSS Vendor url:http://www.xoops-mexico.net/ Advisore:http://lostmon.blogspot.com/2008/08/ rmsoft-downloads-plus-two-scripts-two.html Vendor notify:no exploits availables:yes RMSOFT Downloads Plus is a download php/Mysql script module for multiple CM...

OpenImpro 1.1 - image.php SQL Injection

OpenImpro 1.1 - image.php SQL Injection OpenImpro 1.1id Sql Injection Vulnerability Author: nuclear script: http://downloads.sourceforge.net/openimpro/openimpro-1.1.zip exploit: target.com/image.php?id=-1 union select 1,2,concatfirstname,0x3a,lastname,0x3a,password,4,5,6 from imperson --...

RMSOFT Downloads Plus - (rmdp) 1.51.7 Module for XOOPS down.php?id Cross-Site Scripting

RMSOFT Downloads Plus - rmdp 1.51.7 Module for XOOPS down.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

RMSOFT Downloads Plus - (rmdp) 1.51.7 Module for XOOPS search.php?key Cross-Site Scripting

RMSOFT Downloads Plus - rmdp 1.51.7 Module for XOOPS search.php?key Cross-Site Scripting source: https://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS search.php?key' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting...

RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS down.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting...

mozilocms-download.txt

!/usr/bin/perl moziloCMS 1.10.1 Perl exploit discovered & written by Ams ax330d doggy gmail dot com DESCRIPTION: Vulnerability hides in "download.php", which we can use to download any file we want to. Here, for example, "admin/conf/logindata.conf". Btw, not very smart solution to keep it open no...

HIOX Browser Statistics 2.0 - Arbitrary Add Admin

"; fclose$file; $creat = "false"; echo "New User Created Please Wait You will be Redirected to Login Page "; else echo "Enter correct Username or Password "; if$creat == "true" ? table align=center valign=center bgcolor=000000 align=center cellpadding=0 style="border: 1p...

WordPress Wp Downloads Manager 'upload.php'任意文件上传漏洞

BUGTRAQ ID: 30365 CNCAN ID：CNCAN-2008072803 WordPress Wp Downloads Manager是一款WordPress的下载管理程序。 WordPress Wp Downloads Manager不正确过滤用户提交的WEB数据，远程攻击者可以利用漏洞上传任意文件。 问题存在于'upload.php'中，攻击者可上传恶意PHP文件，并以WEB权限执行。 Giulio Ganci Wp Downloads Manager 0.2 目前没有解决方案提供：...

Unfixed XSS vulnerability at www.bestvistadownloads.com

Security researcher Zeryus, has submitted on 07/06/2008 a cross-site-scripting XSS vulnerability affecting www.bestvistadownloads.com, which at the time of submission ranked 11661 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/06/2008. It i...

Directory traversal

Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 thumbtemplate parameter to a admin/templates/templatethumbnail.php, and the 2...

Trac quickjump Search Script q Parameter Arbitrary Site Redirect

The remote host is running Trac, an enhanced wiki and issue tracking system for software development projects. The version of Trac installed on the remote host fails to sanitize user input to the 'q' parameter of the 'search' script before using it in an unfiltered and unmanaged fashion in a...

theratcms-sqlxss.txt

========================================================== The Rat CMS SQL/XSS Multiple Remote Vulnerabilities ========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

Easy-Clanpage 3.0b1 (section) Local File Inclusion Vulnerability

No description provided by source. LFI Exploit by Loader007 you can connect me for questions ICQ:488525928 Script:Easy-Clanpage 3.0b1 download: http://www.easy-clanpage.de/?section=downloads&show=viewdownload&id=24 http://example.de/path/?section=LFI%00 HowTo use it 1: make a account 2: up shell ...

Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting

==================================================================== Gravity Board X 2.0 Beta SQL/XSS Multiple Remote Vulnerabilities ==================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking...

Akamai Download Manager < 2.2.3.7 - ActiveX Remote Download

Download Manager window.resizeTo500,510; var bDocReady = false; var bInsObj = false; var isLinux = navigator.userAgent.indexOf"Linux" = 0; var isMacFF = navigator.userAgent.indexOf"Firefox" = 0 && navigator.userAgent.indexOf"Mac" = 0; var isSafari = navigator.userAgent.indexOf"Safari" = 0; var...

c6msg-activex.txt

!-- C6 Messenger Installation Url DownloaderActiveX Control Remote Download & Execute Exploit by Nine:Situations:Group::SnoopyAssault site: http://retrogod.altervista.org/ "C6 Messenger is an instant messaging program produced by Telecom Italia Group, specifically by Alice distribution, Icon Spa...

meBiblio 0.4.7 (SQL/Upload/XSS) Multiple Remote Vulnerabilities

No description provided by source. ======================================================================================== meBiblio 0.4.7 Remote SQL Injection/ Arbitrary File Upload Exploit / XSS Vulnerability ======================================================================================...

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion :...