Amateur Photographer 's Image Gallery 0.9a XSS / SQL Injection

Amateur Photographer's Image Gallery version 0.9a suffers from cross site scripting, remote file disclosure, and remote SQL injection vulnerabilities. Undergroundthalo Hacking Team - Security Advisory --------------------------------------------------------------------------- Author : cr4wl3r...

anwsion任意文件下载漏洞

简要描述： anwsion任意文件下载漏洞 详细说明： 不解释，代码逻辑有问题。 http://wenda.anwsion.com/file/download/?filename=Y29uZmlnLnBocA==&url=Lmh0dHA6Ly93ZW5kYS5hbndzaW9uLmNvbS91cGxvYWRzLi9zeXN0ZW0vY29uZmlnL2RhdGFiYXNlLnBocA== 漏洞证明：...

Tech-ex kesioncms7. 0 arbitrary File Download vulnerability-vulnerability warning-the black bar safety net

Tech-ex kesioncms7 vulnerability, is a high-risk vulnerability Vulnerability detection method: The first registered user login, Access/user/Contributor. asp can see a few can contribute to the classification, select the software submission. Point the next step! Then skip to:/user/UserMySoftWare...

NGS00266 Patch Notification: Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL

Medium risk vulnerability in Symantec Messaging Gateway 18 September 2012 Ben Williams of NCC Group has discovered a Medium risk vulnerability in Symantec Messaging Gateway Impact: Authenticated arbitrary file download Versions affected: Symantec Messaging Gateway 9.5.3-3 An updated version of th...

HP SiteScope getFileInternal Arbitrary File Download

The version of HP SiteScope hosted on the remote web server has an arbitrary file download vulnerability. The application hosts a web service that allows the getFileInternal method to be invoked without authentication. A remote, unauthenticated attacker could exploit this to download arbitrary...

Symantec Messaging Gateway 9.5.x Multiple Vulnerabilities (SYM12-013)

According to its self-reported version number, the version of Symantec Messaging Gateway running on the remote host is 9.5.x and has the following vulnerabilities : - Multiple XSS vulnerabilities exist. CVE-2012-0307 - Lack of password protection on sensitive functions as well as of CSRF protecti...

Cross site scripting

Cross-site scripting XSS vulnerability in the filedownload function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter...

CVE-2012-4873

GNUBoard is vulnerable to an XSS in the file_download function via the filename parameter, affecting versions before 4.34.21. The root cause is improper handling of the filename input leading to script/HTML injection. Remediation: upgrade to GNUBoard 4.34.21 or apply the provided patch. Public re...

Symantec Messaging Gateway Security Issues

SUMMARY Symantec's Messaging Gateway management console is susceptible to several security issues including cross-site scripting/cross-site request forgery, an SSH account with a default password, file downloads and potential web application modifications. Successful exploitation could result in...

Generic HTTP Directory Traversal Utility

This module allows you to test if a web server or web application is vulnerable to directory traversal with three different actions. The 'CHECK' action default is used to automatically or manually find if directory traversal exists in the web server, and then return the path that triggers the...

CVE-2012-4596

Directory traversal vulnerability in McAfee Email Gateway MEG 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL...

IOServer 1.0.18.0 Directory Traversal / File Download

===================================================================== BEGIN Foofus.net Security Advisory: foofus-20120817 BEGIN ===================================================================== Title: IOServer "Root Directory" Trailing Backslash Web Server Vuln Allows: Arbitrary File Access,...

IBM WebSphere Portal Dojo Module URI Traversal Arbitrary File Access

The version of WebSphere Portal on the remote host is using a vulnerable version of the Dojo toolkit. Input to the 'path' parameter of layerLoader.jsp is not properly validated. A remote, unauthenticated attacker could exploit this to download arbitrary files. %NASLMINLEVEL 70300 C Tenable Networ...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields which could then be read by an attacker. CVE-2009-3370 A flaw was found in the way Firefox creates temporary file...

Xoops Extgallery 1.0.8 Shell Upload / File Download

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Xoops Module (extgallery-v1.0.8) Multiple Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Symantec Web Gateway 5.0.28 LFI / Code Execution

Software: Symantec Web Gateway Current Software Version: 5.0.2.8 Product homepage: www.symantec.com Author: S2 Crew Hungary CVE: CVE-2012-0297, CVE-2012-0298, ??? File include: https://192.168.82.207/spywall/previewProxyError.php?err=../../../../../../../../etc/passwd File include and OS command...

symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities

Software: Symantec Web Gateway Current Software Version: 5.0.2.8 Product homepage: www.symantec.com Author: S2 Crew Hungary CVE: CVE-2012-0297, CVE-2012-0298, ??? File include: https://192.168.82.207/spywall/previewProxyError.php?err=../../../../../../../../etc/passwd File include and OS command...

Symantec Web Gateway 5.0.2.8 Multiple Vulnerabilities

Exploit for linux platform in category web applications Software: Symantec Web Gateway Current Software Version: 5.0.2.8 Product homepage: www.symantec.com Author: S2 Crew Hungary CVE: CVE-2012-0297, CVE-2012-0298, ??? File include:...

symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities

symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities Software: Symantec Web Gateway Current Software Version: 5.0.2.8 Product homepage: www.symantec.com Author: S2 Crew Hungary CVE: CVE-2012-0297, CVE-2012-0298, ??? File include:...