xAjax Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting and Full path disclosure vulnerabilities in xAjax and xajaxjqueryplugin. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of xAjax. Vulnerable are all versions of...

Уязвимости в xAjax и xajax_jquery_plugin

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting и Full path disclosure уязвимостях в xAjax и xajaxjqueryplugin. XSS WASC-08: http://site/cms/’;alertdocument.cookie;/ Это DOM Based XSS. Данная уязвимость в частности имеет место в MC Content Manager которая использует xAjax...

Vulnerabilities in MC Content Manager

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting, Brute Force и Full path disclosure уязвимостях в MC Content Manager. Это украинская коммерческая CMS. XSS WASC-08: http://site/cms/’;alertdocument.cookie;/ Brute Force WASC-11: http://site/admin/ Full path disclosure WASC-13:...

MC Content Manager 10.1.1 Cross Site Scripting / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting, Brute Force and Full path disclosure vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of MC Content Manage...

phpMySport 1.4 - SQL Injection / Authentication Bypass / Full Path Disclosure

Vulnerability ID: HTB22770 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

phpMySport 1.4 - SQL Injection Authentication Bypass Full Path Disclosure

phpMySport 1.4 - SQL Injection Authentication Bypass Full Path Disclosure Vulnerability ID: HTB22770 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphpmysport.html Product: phpMySport Vendor: phpMySport http://phpmysport.sourceforge.net/ Vulnerable Version: 1.4 Vendor Notification: 21...

Уязвимости в Register Plus Redux для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Insufficient Anti-automation и Full path disclosure уязвимостях в плагине Register Plus Redux для WordPress. Register Plus Redux - это разветвление fork плагина Register Plus. XSS WASC-08: POST запрос на странице...

Vulnerabilities in Register Plus Redux for WordPress

Hello Bugtraq! I want to warn you about Cross-Site Scripting, Insufficient Anti-automation and Full path disclosure vulnerabilities in plugin Register Plus Redux for WordPress. Register Plus Redux is a fork of plugin Register Plus. ------------------------- Affected products:...

etomite 1.1 - Multiple Vulnerabilities

Vulnerability ID: HTB22710 Reference: http://www.htbridge.ch/advisory/sqlinjectioninetomite.html Product: Etomite Vendor: http://www.etomite.org/ http://www.etomite.org/ Vulnerable Version: 1.1 Vendor Notification: 18 November 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendor...

Vulnerabilities in Register Plus for WordPress

Hello Bugtraq! I want to warn you about Cross-Site Scripting, Insufficient Anti-automation and Full path disclosure vulnerabilities in plugin Register Plus for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are versions of plugin Register Plus 3.5.1 a...

Register Plus <= 3.5.1 - Full Path Disclosure

It is unclear whether or not the issue has been fixed. Plugin has been closed...

S-CMS 2.5 Multiple Vulnerabilities

Exploit for php platform in category web applications ================================== S-CMS 2.5 Multiple Vulnerabilities ================================== ============================================================ Exploit Title: S-CMS Multiple Vuln Date: 14/11/2010 Author: LordTittiS...

S_CMS 2.5 - Multiple Vulnerabilities

SCMS 2.5 - Multiple Vulnerabilities ============================================================ Exploit Title: S-CMS Multiple Vuln Date: 14/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.matteoiammarrone.com http://www.matteoiammarrone.com/public/s-cm...

S_CMS 2.5 - Multiple Vulnerabilities

============================================================ Exploit Title: S-CMS Multiple Vuln Date: 14/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.matteoiammarrone.com http://www.matteoiammarrone.com/public/s-cms/ Vulnerability Type: Full Path...

Invision Power Board 3 SQL Injection

============================================================ Exploit Title: Invision Power Board 3 Multiple Vuln Date: 13/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.invisionpower.com/ Vulnerability Type: Full Path Disclosure Version: 3.x.x All 3...

Invision Power Board 3 - 'search_app' SQL Injection

============================================================ Exploit Title: Invision Power Board 3 Multiple Vuln Date: 13/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.invisionpower.com/ Vulnerability Type: Full Path Disclosure Version: 3.x.x All 3...

Invision Power Board 3 - search_app SQL Injection

Invision Power Board 3 - searchapp SQL Injection ============================================================ Exploit Title: Invision Power Board 3 Multiple Vuln Date: 13/11/2010 Author: LordTittiS Greetings To: GodOfPain, SystemOveride Software Link: http://www.invisionpower.com/ Vulnerability...

Уязвимости в PHPShop

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation, Cross-Site Scripting, Denial of Service и Full path disclosure уязвимостях в PHPShop. Это движок для онлайн магазинов. Insufficient Anti-automation WASC-21: http://site/users/register.html На данной странице...

Punbb 1.3.4 Full Path Disclosure Vulnerability

Exploit for php platform in category web applications ============================================== Punbb 1.3.4 Full Path Disclosure Vulnerability ============================================== Exploit Title: Punbb 1.3.4 Full Path Disclosure Date: 07/11/2010 Author: SYSTEMOVERIDE, OverSecurityCr...

Punbb 1.3.4 - Multiple Full Path Disclosures

Exploit Title: Punbb 1.3.4 Full Path Disclosure Date: 07/11/2010 Author: SYSTEMOVERIDE, OverSecurityCrew Software Link: http://punbb.informer.com/ Vulnerability Type: Full Path Disclosure Version: 1.3.4 Vulnerability Details: The vulnerabilities are in the file and the file /search.php,...