ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities

No description provided by source. Title: ====== ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Date: ===== 2012-11-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=689 VL-ID: ===== 689 Common Vulnerability Scoring System: ====================================...

Invision Power Board 1.x Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13802/info Invision Power Board is affected by an unauthorized access vulnerability. Reportedly, a moderator can edit forum posts owned by other moderators through an HTTP GET request without providing sufficient...

Woltlab Burning Board 2.x ModCP.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14617/info Woltlab Burning Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

OpenBB 1.0 Unauthorized Moderator Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4823/info OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems. OpenBB is reported to be vulnerable to a condition that will allow an...

HTTPDX tolog() Function Format String Vulnerability

No description provided by source. $Id: httpdxtologformat.rb 10150 2010-08-25 20:55:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms ...

"4chan Hacked", Most Popular Image-Bulletin Board Compromised

The founder of 4chan, Christopher Poole, aka “moot” has confirmed few hours ago, in a blog post that the popular image-based bulletin board was hacked. The attacker gained access to the administrative functions and successfully hacked into one of 4chan’s database by exploiting a website's softwar...

WordPress Plugin Hms Testimonials 2.0.10 - Multiple Vulnerabilities

WordPress Plugin Hms Testimonials 2.0.10 - Multiple Vulnerabilities Update ======================== Fixed wrong dates. Details ======================== Application: HMS Testimonials http://wordpress.org/plugins/hms-testimonials/ Version: 2.0.10 Type: Wordpress Plugin Vendor: Jeff Kreitner...

Veracode's VP of Research Chris Eng, Moderator of the Dangers in Mobile Devices Session

Chris Eng of Veracode moderated the mobile threats track...

SCADA and ICS Security Session Moderator Tiffany Rad

Tiffany Rad, who moderated the ICS security track, talked about the restrictions that laws such as the DMCA can place on security researchers looking at new systems...

vBulletin Announcements Cookie Steal Vulnerability

If you get access to a forum with an acc that only has default acp, you can get all users information by creating a cookie stealer in announcements. vBulletin Announcements, by default has html enabled, so if you get access to a forum using other exploits and get a user with acp info, but it only...

ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities

ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Title: ====== ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Date: ===== 2012-11-15 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=689 VL-ID: ===== 689 Common Vulnerability Scoring System:...

Vanilla Forums 2.0.18.4 - Tagging Persistent Cross-Site Scripting

Vanilla Forums 2.0.18.4 - Tagging Persistent Cross-Site Scripting Title: Vanilla Tagging Stored XSS Date: 1/6/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 http://vanillaforums.org/download Create a new thread and post you...

Vanilla Forums 2.0.18.4 - Tagging Persistent Cross-Site Scripting

Title: Vanilla Tagging Stored XSS Date: 1/6/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 http://vanillaforums.org/download Create a new thread and post your XSS as tag. I used alert'xss' You will have to use a proxy /...

Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting

Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting Title: Vanilla Tagging Enchanced 1.0.1 Stored XSS Date: 1/6/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 + Tagging Enhanced plugin 1.0.1...

Genium CMS 2012Q2 - Multiple Vulnerabilities

Genium CMS 2012Q2 - Multiple Vulnerabilities Title: ====== Genium CMS 2012|Q2 - Multiple Web Vulnerabilities Date: ===== 2012-05-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=517 VL-ID: ===== 517 Introduction: ============= Durch den Einsatz von Genium CMS können S...

MYRE Real Estate Mobile 2012|2 - Multiple Vulnerabilities

Document Title: =============== MYRE Real Estate Mobile 2012|2 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=516 Release Date: ============= 2012-04-30 Vulnerability Laboratory ID VL-ID: ==================================== 5...

Havalite CMS 1.0.4 - Multiple Vulnerabilities

Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It\\\'s licensed...

Website Toolbox Cross Site Scripting

Exploit Title: Website Toolbox Cross Site Scripting Date: 7.04.2012 Author: Sony Software Link: http://websitetoolbox.com Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC: http://st2tea.blogspot.com/2012/04/website-toolbox-cross-site-scripting.html...

IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability

Document Title: =============== IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability Release Date: ============= 2011-07-08 Vulnerability Laboratory ID VL-ID: ==================================== 108 Product & Service Introduction: =============================== IceBB is a powerful, fast, free, a...

Linux distributor security list destroyed after hacker compromise !

Hackers have compromised a private e-mail list used by Linux and BSD distributors to share information on embargoed security vulnerabilities and used a backdoor to sniff e-mail traffic, according to the moderator of the list. In a note to "Vendor-Sec" members, moderator Marcus Meissner said he...