CVE-2013-0734

Product/Version: Mingle Forum WordPress plugin (pre-1.0.34). Vulnerabilities: Multiple XSS in two parameters: (1) search_words in wpf.class.php; (2) togroupusers in fs-admin/fs-admin.php. Impact: Remote attackers can inject arbitrary web script or HTML. Exploitation context: Noted as XSS vulnerab...

Full Disclosure List Rises From the Ashes For Fresh Start

When the Full Disclosure mailing list closed down last week, many in the security community wondered what, if anything, would fill the void. As it turns out, Full Disclosure will fill that void. John Cartwright, one of the creators of the list, announced on March 19 that he was shutting it down...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

Code injection

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The vulnerability CVE-2014-0124 affects Moodle: identity-reporting in mod/forum/renderer.php and mod/quiz/override_form.php allows remote authenticated users to see e-mail addresses. Affected versions include Moodle up to 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2. Imp...

Full Disclosure Security Mailing List Shuts Down

The Full Disclosure security mailing list, which has been one of the main discussion forums for vulnerability and exploit information for 12 years, is shutting down because “‘one of our own’ would undermine the efforts of the last 12 years”, one of the creators said. John Cartwright, one of the...

GNUboard SQL Injection

========================== Advisory: GNUboard SQL Injection Vulnerability Author: [email protected] Affected Version: GNUboard5the latest version Vendor URL: http://sir.co.kr/ Vendor Status: UnfixedI know little about Korean，so i do not know how to describe this vul to the vendor...

XDA Forum hackers again proof Sony Xperia Z2 UI-bug warning-the black bar safety net

Recently a senior XDA developer Forum member in the online release of more than one Xperia Z2 real machine picture, and shows the phone running Android 4.3 system, using the new UI, the phone use is very unstable, the UI has been crashing. Today, the XDA member latest release of the Xperia Z2...

Microsoft, Kaspersky Shed Light on Sefnit Tor Botnet

Alarm bells went off last August when spikes in Tor client downloads were traced to a large click-fraud and Bitcoin-mining botnet called Sefnit. The malware was using the popular anonymity network to communicate with hackers in order to transmit stolen data and receive additional commands. In...

Forum Livre info_user.asp user Parameter SQL Injection - Ver2 (CVE-2007-0589)

An SQL injection vulnerability has been reported in Forum Livre. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2014-2091

Cross-site scripting XSS vulnerability in mods/standard/forums/admin/forumadd.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an addforum action. NOTE: the original disclosure also reported issues that may not cross...

CVE-2014-2091

Cross-site scripting XSS vulnerability in mods/standard/forums/admin/forumadd.php in ATutor 2.1.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the title parameter in an addforum action. NOTE: the original disclosure also reported issues that may not cross...

phpBB远程拒绝服务漏洞

Bugtraq ID:65481 phpBB是phpBB组开发的一套开源的使用PHP语言开发的Web论坛软件。该软件具有支持多国语言、支持多种数据库和自定义版面设计等特点。 phpBB中存在远程拒绝服务漏洞。攻击者可利用该漏洞造成受影响应用程序崩溃，拒绝服务合法用户。 0 phpBB phpBB 3.0.8 phpBB phpBB 3.0.7 phpBB phpBB 3.0.6 phpBB phpBB 3.0.5 phpBB phpBB 3.0.4 phpBB phpBB 3.0.3 phpBB phpBB 3.0.2 phpBB phpBB 3.0.1 phpBB phpBB 3.0...

[Killtrojan Syslog] Tool to detect malware activity on a system

Killtrojan Syslog is a free application to create a report about characteristics of the system to further analyze and look for signs of malware, also is intended to put the report in a specialized forum for users to help. The tool has a very intuitive and easy to use for non-technical users to...

MyBB Database Fingerprint

This module checks if MyBB is running behind an URL. Also uses a malformed query to force an error and fingerprint the backend database used by MyBB on version 1.6.12 and prior. Module Options msf use auxiliary/gather/mybb/dbfingerprint msf undefineddbfingerprint show actions ...actions... msf...

VEGO Web Forum index.php theme_id Parameter SQL Injection - Ver2 (CVE-2006-0065)

An SQL injection vulnerability has been reported in VEGO Web Forum. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

OABOARD Web Forum forum.php inc Parameter PHP Code Execution - Ver2 (CVE-2006-0076)

A code execution vulnerability has been reported in OABoard. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2012-6622

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

CVE-2012-6623

The CVE-2012-6623 issue affects the WordPress plugin ForumPress WP Forum Server (affected: ForumPress WP Forum Server plugin before 1.7.5). The vulnerability is an XSS in fs-admin/wpf-add-forum.php, exploitable via the groupid parameter in an addforum action to wp-admin/admin.php, allowing remote...