contentcustom-disclose.txt

CONTENTCustomizer Trick: Hit Ctrl+Y on a page that ContentCustomizer controls and it brings you to the login screen ; Dork: inurl:"generator/default.php?doc=" Other fun stuff: dialog.php?action=del&doc='+pagename // Delete dialog.php?action=delbackup&doc='+pagename // Delete Backup...

Code injection

include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code...

CVE-2007-5431

include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code...

CVE-2007-5431: Exposure of Sensitive Information to an Unauthorized Actor

include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code...

Cross site scripting

Cross-site scripting XSS vulnerability in session.cgi aka the login page in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, a different vulnerability than CVE-2007-4713. NOTE: this can be leveraged to capture login credential...

Improper access control

Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...

CVE-2007-5063

Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...

CVE-2007-5063

Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing login credentials via a direct request for var/users.txt...

CVE-2007-5063

CVE-2007-5063 affects Flip 3.0 and earlier, where sensitive information is stored under the web root with insufficient access control. An unauthenticated remote attacker can directly request var/users.txt and download a file containing login credentials. The provided documents do not specify affe...

Design/Logic Flaw

Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote attackers to obtain sensitive information via a '" ' double-quote space sequence followed by the -autologin and -loginuri arguments, whic...

blogsite-sql.txt

--==+================================================================================+==-- --==+ BlogSite Professional SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK:...

SOL4369 - Configuration utility login vulnerability - CR45786

BIG-IP 9.0.2 through 9.0.4 cache login credentials for the Configuration utility. Once a user is logged in, the cache does not check the password entered for additional sessions under that user name. As a result, it is possible to gain access to the BIG-IP Configuration utility without a password...

CVE-2007-2619

CVE-2007-2619 affects Symantec pcAnywhere 11.5.x and 12.0.x, where unencrypted login credentials can reside in process memory. The description indicates local administrators can read memory to retrieve credentials, making this a local access issue. No explicit exploit details or mitigation are pr...

CVE-2007-2619: Undefined Security Weakness

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

GLSA-200704-18 : Courier-IMAP: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200704-18 Courier-IMAP: Remote execution of arbitrary code CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. Impact : A remote attacker could...

Courier-IMAP: Remote execution of arbitrary code

Background Courier-IMAP is an IMAP server which is part of the Courier mail system. It provides access only to maildirs. Description CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. Impact A remote attacker...

Design/Logic Flaw

axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service NULL dereference and application crash via a base64-encoded "\x00" sequence on the imap port 143/tcp...

Aztek Forum 4.0 - Multiple Vulnerabilities

!/usr/bin/php Aztek Forum 4.1 Multiple Vulnerabilities Exploit header ================================================== sploit Owner - root status Trying to register a new user sploit Login/Password - phpsploit8435 status Trying to get database informations sploit Full Path Disclosure -...

TorrentFlux 2.2 (maketorrent.php) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ================================================================== TorrentFlux 2.2 maketorrent.php Remote Command Execution Exploit ================================================================== The variable announce in maketorrent.php...

Microsoft Windows Web Client缓冲区溢出漏洞（MS06-008）

Microsoft Windows是微软发布的非常流行的操作系统。 Microsoft Windows的Web Client服务中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在主机上执行任意指令。 远程攻击者可以通过向有漏洞系统发送特制的WebDAV请求导致执行任意指令。但是，攻击者必须拥有有效的登录凭据才可以利用这个漏洞。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003...