710 matches found
Research Outlines New Deep Freeze Data Recovery Technique on Android Phone
Hackers and data recovery specialists alike could soon be turning to a new technique that under the right conditions can allow for the harvesting of personal information from phones, even after they’ve been frozen. A group of German researchers from the University of Erlangen-Nuremberg have...
Blogman 0.7.1 SQL Injection
!/usr/bin/python Exploit Title: Blogman v0.7.1 profile.php SQL Injection Exploit Date : 28 August 2010 Author : Ptrace Security Gianni Gnesa gnix Contact : researchatptrace-securitydotcom Software Link: http://sourceforge.net/projects/blogman/ Version : 0.7.1 Tested on : EasyPHP 5.3.1.0 for Windo...
NetScaler web management cookie information
It is possible to extract information about the remote Citrix NetScaler appliance obtained from the web management interface SPDX-FileCopyrightText: 2008 nnposter Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Stash 1.0.3 (SQL) User Credentials Disclosure Exploit
No description provided by source. !/usr/bin/perl -w User credentials disclosure exploit - stash103exp.pl Gnix [email protected] http://gnix.netsons.org This exploit use an SQL Injection in the file admin/login.php to bypass the login, and then an SQL Injection in the admin/news.php to extract a...
getID3 < 1.7.8-b1 Multiple Remote Vulnerabilities
getID3, a web-based tool for extracting information from MP3 files, is installed on the remote web server. The installation of getID3 includes a set of demo scripts that allow an unauthenticated, remote attacker to read and delete arbitrary files, write files with some restrictions, and execute...
Javascript prompt origin spoofing — Mozilla
Alerts and prompts created by scripts in web pages are presented with the generic title JavaScript Application which sometimes makes it difficult to know which site created them. A malicious page could attempt to cause a prompt to appear in front of a trusted site in an attempt to extract...
event Calendar - Multiple Vulnerabilities
event Calendar - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/11693/info Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported: A cross-site...
YabbSE (3 on 1)
Summary YaBB SE is a PHP/MySQL port of the popular forum software YaBB yet another bulletin board. This time we discovered three new holes. That ranges from extracting information to deleting information and files in the remote web server. Details Vulnerable Systems: YaBB SE versions 1.5.4, 1.5.5...
Multiple SQL injection on OpenBB forums
/----------------------------------------------------------------------------- | 7 A 6 9 - A d v C: 008 |-----------------------------------------------------------------------------| | | SQL injection on OpenBB forums | ----------------------------------------------------------------------------...
IBM NetCommerce Security
hola friends, while i was participating on the openhack contest i found a couple of serious security-holes within ibm s so called "netcommerce" thing which seems to be a mixture of websphere, net.data, servlets, jsp s and db2? however..summary: class: input validation error remote: yes local: yes...