CVE-2012-6622

The CVE-2012-6622 entry concerns the ForumPress WP Forum Server WordPress plugin, specifically the fs-admin/fs-admin.php component, which is vulnerable to multiple XSS flaws. The vulnerability exists in version prior to 1.7.4 and is triggered via the groupid parameter in an editgroup action or th...

WordPress WP Forum Server Plugin <= 1.7.4 - XSS

Because of this vulnerability in fs-admin/wpf-add-forum.php, the attackers can inject arbitrary web script or HTML via the "groupid" parameter. Solution Update the plugin...

WordPress WP Forum Server Plugin <= 1.7.3 - SQL Injection

Because of this vulnerability in fs-admin/fs-admin.php, the attackers can execute arbitrary SQL commands via the "groupid" parameter in an editgroup action. Solution Update the plugin...

最新版通达OA几处存储型XSS

简要描述： 最新版通达OA几处存储型XSS 详细说明： 测试版本：下载 通达OA 2013增强版125MB 下载地址：http://www.tongda2000.com/download/2013adv.php 更新于 2013-12-26 13:30 1、讨论区发帖处发帖内容存储型XSS 2、回答“OA知道”问题时以源码方式编辑存在存储型XSS： 漏洞证明： img src="https://images.seebug.org/upload...

MyBB 1.6.12 - Admin Panel FPD & Multiple XSS

Latest mybb forums suffers on multiple persistent cross site scripting vulnerability and single full path disclosure. Probably, there are more bugs because of poor content filtration. Title: MyBB 1.6.12 - Admin Panel FPD & Multiple XSS Date: 01.11.2014 Tested on: Linux 3.7-trunk-686-pae 1 SMP...

Exclusive - openSUSE Forum Hacked; 79500 Users Data Compromised

After Snapchat hack, this can be another worst data breach of the new year. A Pakistani hacker 'H4x0r HuSsY' has successfully compromised the official Forum of 'openSUSE', a Linux distro developed, sponsored & supported by SUSE. The hacker managed to deface the Forum and uploaded its custom messa...

VEGO Web Forum index.php theme_id Parameter SQL Injection - Ver2 (CVE-2006-0065)

An SQL injection vulnerability has been reported in VEGO Web Forum. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

VEGO Web Forum login.php username Parameter SQL Injection - Ver2 (CVE-2006-0067)

An SQL injection vulnerability has been reported in VEGO Links Builder. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

OABOARD Web Forum forum.php inc Parameter PHP Code Execution - Ver2 (CVE-2006-0076)

A code execution vulnerability has been reported in OABoard. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

PrisonLocker Ransomware Emerges From Criminal Underground

Security researchers from Malware Must Die uncovered new ransomware called PrisonLocker, and said the malware author is either a legitimate security researcher or is posing as one via a personal blog and Twitter handle. Malware Must Die has monitored PrisonLocker’s development since spotting it f...

startbbs论坛存在两处漏洞

简要描述： rank rank 详细说明： startbbs 存在一处越权和一处刷关注 先说越权 先自己回复一下，看一下url。 然后自己修改url 然后修改成第一条回复。 想修改哪条就修改哪条。我就用第一条测试。 http://www.startbbs.com/comment/edit/1/1/1 http://www.startbbs.com/comment/edit/1/1254/3888 这是自己回复的url 点击编辑。 已经成功。 已经成功。 然后就是 刷关注。 http://www.startbbs.com/follow/add/2587 直接访问这个url就 关注了这个用户...

MyBB多个SQL注入和跨站脚本漏洞

BUGTRAQ ID: 64570 MyBB是一个功能完整并且非常实用的论坛软件。 MyBB 1.6.12之前版本在实现上存在多个SQL注入及跨站脚本漏洞，成功利用后可使攻击者窃取cookie身份验证凭证、执行未授权数据库操作。这些漏洞源于没有正确过滤某些输入，这些输入相关ACP内编辑表情符号、用Akismet删除帖子、视频MyCode、表情符号提示符等。 0 MyBB MyBB 1.x 厂商补丁： MyBB ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.mybb.com/...

startbbs开源论坛存储型xss可盲打管理员

简要描述： rt 详细说明： 前面发的2发存储型xss危害可能都没那么大，但是这次存储型xss出现的位置在帖子正文，访问就中。 漏洞产生的原因：对规则过滤不严可以绕过。 以官方为例： 发布一条帖子，标题什么的随意。正文填入如下代码： 保存一下： 漏洞证明： 访问帖子： 具体利用可以参考实例2...

Discuz! X2.5 api.php 信息泄露漏洞

Discuz!是国内一套通用的社区论坛软件系统。 Discuz! X2.5 api.php文件中由于arraykeyexists中的第一个参数只能为整数或者字符串，当?mod=ks时，$mod类型为array，从而导致arraykeyexists产生错误信息。 0 Discuz! X2.5...

CVE-2013-6936

Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat Ajaxfs Plugin 2.0 for MyBB aka MyBulletinBoard allow remote attackers to execute arbitrary SQL commands via the 1 tooltip or 2 usertooltip parameter...

Sql injection

Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat Ajaxfs Plugin 2.0 for MyBB aka MyBulletinBoard allow remote attackers to execute arbitrary SQL commands via the 1 tooltip or 2 usertooltip parameter...

CVE-2013-6936

CVE-2013-6936 describes multiple SQL injection vulnerabilities in the Ajaxfs plugin (MyBB), specifically in ajaxfs.php via the tooltip and usertooltip parameters in the Ajax forum stat plugin 2.0. Remote attackers could execute arbitrary SQL commands. OpenVAS notes a WillNotFix remediation.

CVE-2013-6936

Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat Ajaxfs Plugin 2.0 for MyBB aka MyBulletinBoard allow remote attackers to execute arbitrary SQL commands via the 1 tooltip or 2 usertooltip parameter...

i2Ninja Financial Malware Communicates on I2P Darknet

The Mevade botnet made news when it was found to be using the Tor anonymity network to communicate with its command and control infrastructure. Running C&C on Tor, however, turned out to be a fatal mistake when Tor usage spiked alerting administrators to the unusual activity. A group of Russian...

vBulletin Zero Day Used to Hack MacRumors, vBulletin

A hacker group calling itself Inj3ct0r is taking responsibility for the compromise of more than 860,000 passwords at MacRumors.com as well as a separate attack on vBulletin.com, makers of the vBulletin software powering a number of high-profile forums including MacRumors and Ubuntu Forums. The...