WeBid - Multiple Cross-Site Scripting LDAP Injection Vulnerabilities

WeBid - Multiple Cross-Site Scripting LDAP Injection Vulnerabilities source: https://www.securityfocus.com/bid/68519/info WeBid is prone to multiple cross-site-scripting vulnerabilities and an LDAP injection vulnerability. An attacker may leverage these issues to compromise the application, acces...

OpenVAS Manager 4.0 - Authentication Bypass

!/usr/bin/python Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC Date: 09/07/2014 Exploit Author: EccE Vendor Homepage: http://www.openvas.org/ Software Link: http://wald.intevation.org/frs/?groupid=29 Version: OpenVAS Manager 4.0 Tested on: Debian GNU/Linux testing...

Quick.Cart 6.4 & Quick.Cms 5.4 - Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Quick.Cart 6.4 & Quick.Cms 5.4 - Cross Site Scripting Date: 09.07.14 Vendor: opensolution.org Affected verions: Quick.Cart and Quick.Cms, latest versions Tested on: Apache 2.2.22 at Debian Contact: smash at devilteam.pl Vulnerabilities...

Microsoft Internet Explorer 9/10 - CFormElement Use-After-Free / Memory Corruption (PoC) (MS14-035)

loaded = false ; function func if loaded document.body.innerHTML = "" ; // free CFormElement input1 = document.getElementById"input1" ; input1.onclick = func ; loaded = true ; input1.click; // Call DoClick function !-- Vulnerability details MSHTML!CInput::DoClick 66943670 8bcf mov ecx,edi 6694367...

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption (PoC) (MS14-035)

Microsoft Internet Explorer 910 - CFormElement Use-After-Free Memory Corruption PoC MS14-035 loaded = false ; function func if loaded document.body.innerHTML = "" ; // free CFormElement input1 = document.getElementById"input1" ; input1.onclick = func ; loaded = true ; input1.click; // Call DoClic...

Yahoo! Bug Bounty #30 YM - Persistent Mail Vulnerability

Document Title: =============== Yahoo! Bug Bounty 30 YM - Persistent Mail Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1137 Release Date: ============= 2014-07-08 Vulnerability Laboratory ID VL-ID: ==================================== 11...

phpokcms 4.x CSRF漏洞

简要描述： 可蠕虫，可添加系统管理员。 详细说明： phpokcms存在csrf漏洞，管理员查看会员列表时不知不觉会自动添加新的系统管理员。 位置在会员头像处的img标签，由于新闻评论可显示头像，也可蠕虫发评论。 下面仅证明添加管理员的部分。 具体代码分析了，直接poc。 漏洞证明： 注册会员后打开如下链接。（域名路径请视情况修改）...

Oracle JRE - java.net.URLConnection class – Same-of-Origin (SOP) Policy Bypass

No description provided by source. Description Security-Assessment.com discovered that a Java Applet making use of java.net.URLConnection class can be used to bypass same-of-origin SOP policy and domain based security controls in modern browsers when communication occurs between two domains that...

CMS ContWEB SQL Injection

Sql Injection on CMS ContWEB - ATI + Date: 02/07/2014 + CWE Number : CWE-89 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.ati.pi.gov.br/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: album.php + Dork : inurl:album.php?id= +...

RelateIQ: Resubmitted with POC #18685 Password reset CSRF

Hey there I found out that an attacker can use the password reset link to forge requests because there is no CSRF token in that particular request to validate that request. You should always have a CSRF token in the password reset request...

Baal Systems <= 3.8 (Auth Bypass) SQL Injection Vulnerability

No description provided by source. + Baal Systems = 3.8 Auth Bypass SQL Injection Vulnerability + Discovered by cr4wl3r cr4wl3r!linuxmail.org + Vuln Code : adminlogin.php ?php includecommon.php; if !empty$POST'password' $username = $POST'username'; $password = $POST'password'; $query = select fro...

Aktiv Player 2.80 Crash PoC

No description provided by source. !/usr/bin/python Exploit Title: aktiv-player version 2.80 Exploit Author: IndonesiaGokilTeam Vendor Homepage: http://www.goforsharing.com/home-mainmenu-1/aktiv-player-mainmenu-131.html Tested on: Windows XP SP 3 sampah= \x42 200 file = openGOKIL.wma,w...

BtiTracker <= 1.4.1 (become admin) Remote SQL Injection Vulnerability

No description provided by source. BtiTracker =v1.4.1 Remote SQL Injection Exploit Discovered by: m@ge|ozz - [email protected] Vulnerabitity: Remote Sql Injection / Problem: Any user can be Administrator Website Vendor: http://www.btiteam.org Vulnerable Code accountchange.php: if isset$GETstyle...

ME Download System <= 1.3 (header.php) Remote Inclusion Vulnerability

No description provided by source. +-------------------------------------------------------------------- + + ME Download System 1.3 Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: ME Download System 1.3 + Venedor ...........:...

Adobe Acrobat <= 9.1.1 Stack Overflow Crash PoC (osx/win)

No description provided by source. Acrobat = 9.1.1 Stack Overflow Crashy PoC http://www.exploit-db.com/sploits/2009-crashytheclown.pdf milw0rm.com 2009-05-29...

Ciscokits 1.0 TFTP Server File Name DoS

No description provided by source. !/usr/bin/python Title: Ciscokits 1.0 TFTP Long Filename DoS Author: Craig Freyman @cd1zz Date: July 22, 2011 Software Link: http://www.certificationkits.com/tftpserver/tftpserver.zip Tested on: Windows XP SP3 Vendor notified: July 22, 2010 - Vendor approved...

Zen Cart 1.3.9f (typefilter) - Local File Inclusion Vulnerability

No description provided by source. Zen Cart v1.3.9f typefilter Local File Inclusion Vulnerability Vendor: Zen Ventures, LLC Product web page: http://www.zen-cart.com Version affected: 1.3.9f Summary: Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML...

UnrealIRCd 3.x Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17057/info UnrealIRCd is prone to a remote denial-of-service vulnerability. A remote attacker may exploit this issue to deny service for legitimate users. !/usr/bin/perl Denial of Service exploit for UnrealIRCd 3.2.3...

Joomla Component News Portal com_news Local File Inclusion Vulnerability

No description provided by source. ================================================================================================================= o Joomla Component News Portal Local File Inclusion Vulnerability Software : comnewsportal version 1.5.x Vendor : http://www.ijoomla.com/ Author :...

frog cms 0.9.5 - Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22685 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinfrogcms.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010...