WordPress Easy Contact Form Lite plugin <= 1.0.7 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Easy Contact Form Lite plugin = 1.0.7 SQL Injection Vulnerability Date: 2011-08-17 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/easy-contact-form-lite.zip Version:...

WordPress Easy Contact Form Lite 1.0.7 SQL Injection

Exploit Title: WordPress Easy Contact Form Lite plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- foreach $POST'fieldnum' as $position=$fieldid if $fieldid 0 $query = " UPDATE $settingstablename SET position = '".$position."' WHERE ID =...

CompactCMS 1.4.1 - Multiple Vulnerabilities

CompactCMS 1.4.1 - Multiple Vulnerabilities Exploit Title: CompactCMS 1.4.1 Multiple Vulnerabilities Google Dork: intext:"Maintained with CompactCMS.nl" intitle:"Print: " Date: 17-12-2010 Author: NLSecurity Software Link: http://files.compactcms.nl/stable/ Version: CompactCMS 1.4.1 Credits:...

Astaro Security Linux 5 - index.fpl Cross-Site Scripting

Astaro Security Linux 5 - index.fpl Cross-Site Scripting source: https://www.securityfocus.com/bid/38893/info Astaro Security Linux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

IBM Lotus Notes 6.5.6 - names.nsf Open Redirection

IBM Lotus Notes 6.5.6 - names.nsf Open Redirection source: https://www.securityfocus.com/bid/38852/info IBM Lotus Notes is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input. A successful exploit may aid in phishing attacks; other...

Apache Tomcat POST数据信息泄露漏洞

No description provided by source...

PHP-Fusion Mod avatar_studio LFI

No description provided by source. Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Also using "avatarselect" you can add yourself a file as avatar which may not be .jpg Proof of concept: POST...

PHP-Fusion Mod avatar_studio LFI

Exploit for unknown platform in category web applications ================================ PHP-Fusion Mod avatarstudio LFI ================================ Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Al...

PHP-Fusion Avatar_Studio Local File Inclusion

Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Also using "avatarselect" you can add yourself a file as avatar which may not be .jpg Proof of concept: POST /infusions/avatarstudio/avatarstudio.php HTTP/1.1...

PHP-Fusion Mod avatar_studio - Local File Inclusion

PHP-Fusion Mod avatarstudio - Local File Inclusion Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Also using "avatarselect" you can add yourself a file as avatar which may not be .jpg Proof of concept: POS...

PHP-Fusion Mod avatar_studio - Local File Inclusion

Tested on: Spanish version By modifying "avatarstudio" parameter at POST data at avatarstudio.php you can retrieve all images at that dir. Also using "avatarselect" you can add yourself a file as avatar which may not be .jpg Proof of concept: POST /infusions/avatarstudio/avatarstudio.php HTTP/1.1...

SOFT64 PHP Whois XSS Vulnerability

No description provided by source. Exploit Title: SOFT64 PHP Whois XSS Vulnerability Date: 24/12/2009 Author: bi0 Software Link: http://blog.soft64download.com/files/ajax-whois.rar /\ == \ /\ \ /\ \ \ \ \ \ \ \ \ /\ \ \ \ \ \ \ \ // // // 01000010 01101001 01001111...

PHP MultiPart Form-Data Denial of Service PoC

No description provided by source. !/usr/bin/python PHP MultiPart Form-Data Denial of Service proof of concept, 23-10-2009 Bogdan Calin [email protected] import httplib, urllib, sys, string, threading from string import replace from urlparse import urlparse def usage: print "" print " PHP...

Apache Tomcat - Form Authentication Username Enumeration

Apache Tomcat - Form Authentication Username Enumeration Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...

Apache Tomcat - Form Authentication 'Username' Enumeration

Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...

SuSE9 Security Update : epiphany (YOU Patch Number 12519)

This update brings the Mozilla SeaMonkey Suite packages to the current stable release 1.1.17. Due to the major version update some incompatibilities might appear. It fixes all currently published security issues, including but not limited to : - Same-origin violations when Adobe Flash loaded via...

Random number generator and input name linebreaks can be used to send custom data to other sites – Opera Security Advisories

Random number generator and input name linebreaks can be used to send custom data to other sites – Opera Security Advisories OPCOM Team | June 10, 2009 Severity Moderately severe Problem description Input names can contain line breaks when data is sent using POST. Suitable use of the random numbe...

Random number generator and input name linebreaks can be used to send custom data to other sites

Input names can contain line breaks when data is sent using POST. Suitable use of the random number generator can reveal predictable boundaries that will be used when sending the POST data. These can be combined to add extra boundaries into the data, containing payloads that may confuse the...

[SECURITY] [DSA 1797-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1797-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 09, 2009 http://www.debian.org/security/faq -...

RedHat Security Advisory RHSA-2009:0436

The remote host is missing updates announced in advisory RHSA-2009:0436. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content...