1914 matches found
Cross-Site Scripting vulnerability in Opera
Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в Opera. При сохранении страницы со “специальным” URL, в коде страницы сохраняется XSS код. И происходит выполнение XSS кода при открытии данной страницы причём её открытии в любом браузере, не только в Opera. XSS:...
Explay CMS <= 2.1 Persistent XSS and CSRF Vulnerability
No description provided by source. ================================== Explay CMS = 2.1 Persistent XSS and CSRF ================================== Discovered by hodik Mail: [email protected] 1. Persistent XSS This CMS has bad anti-XSS filter that cut only some basic vectors. The loginned user can...
explay-xssxsrf.txt
================================== Explay CMS 2. CSRF User can get admin rights if admin open malicious page that contain, for instance: or merely insert it to comment or article text...
Explay CMS 2.1 - Persistent Cross-Site Scripting Cross-Site Request Forgery
Explay CMS 2.1 - Persistent Cross-Site Scripting Cross-Site Request Forgery ================================== Explay CMS 2. CSRF User can get admin rights if admin open malicious page that contain, for instance: or merely insert it to comment or article text. milw0rm.com 2008-09-19...
Explay CMS <= 2.1 Persistent XSS and CSRF Vulnerability
Exploit for unknown platform in category web applications ======================================================= Explay CMS 2. CSRF User can get admin rights if admin open malicious page that contain, for instance: or merely insert it to comment or article text. 0day.today 2018-02-13...
Vulnerabilities in FireStats
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Cross-Site Scripting уязвимостях в FireStats плагине для WordPress и других CMS. Full path disclosure: http://site/wp-content/plugins/firestats/js/firestats.js.php...
Context IS Advisory - MS08-39 OWA XSS
===============================ADVISORY=============================== Systems Affected: Microsoft Outlook Web Access 2003 and 2007 Exchange Server 2003 SP2, Exchange Server 2007, Exchange Server 2007 SP1 Severity: High Category: Cross Site Scripting, Cross Site Request Forgery Author: Context...
gallarific-xss.txt
Hello, I was looking at the free version of gallarific, and I found some suspicious code in the scopbin directory. Attached is a file I found in the zip i downloaded, in case someone wants to decode it. the package can be downloaded from http://www.gallarific.com/download.php Also, the software...
eforum-xss.txt
eForum v0.4 - NON-PERSISTENT XSS by Omni 1 Infos --------- Date : 2008-03-05 Product : eForum Version : v 0.4 Vendor : http://www.phpbrasil.com/scripts/script.php/id/169 Vendor Status : 2008-03-18 Not Informed! 2008-03-18 Published! Description : eForum is an easy-to-install discussion board that...
ZyXEL Gateways Vulnerability Research: http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf
This paper is the result of various security assessments performed on several ZyXEL Prestige devices in both, a controlled environment computer lab and production environments during several penetration tests. There are two types of attacks featured in this paper which we believe might be...
Simple Machines Forum "SMF Shoutbox" Mod Persistent XSS
Simple Machines Forum "SMF Shoutbox" Mod 1.16b-1.14 Reference: http://custom.simplemachines.org/mods/index.php?mod=412 Bug:Persistent XSS SMF Shoutbox is a popular shoutbox mod for Simple Machines Forum.The content of a post variable used to hold the user shout is stored in the database and then...
XSS vulnerabilities in WP-ContactForm
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в WP-ContactForm. Это плагин для WordPress. Данные уязвимости - это persistent XSS. Уязвима версия плагина WP-ContactForm 1.5 alpha и предыдущие. Ранее я уже писал про уязвимости в WP-ContactForm...
bitweaver-sqlxss.txt
HSC Bitweaver XSS & SQL Injection Vulnerability Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate. It comes fully...
isaa-2007-004.txt
============================================= INTERNET SECURITY AUDITORS ALERT 2007-004 - Original release date: November 7th, 2007 - Last revised: December 7th, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...
[ISecAuditors Security Advisories] wwwstats is vulnerable to Persistent XSS
============================================= INTERNET SECURITY AUDITORS ALERT 2007-004 - Original release date: November 7th, 2007 - Last revised: December 7th, 2007 - Discovered by: Jesus Olmos Gonzalez - Severity: 4/5 ============================================= I. VULNERABILITY...
MoBiC-23 Bonus: XSS in Math Comment Spam Protection
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в капче Math Comment Spam Protection. Это капча плагин для WordPress. Для атаки необходимо произвести CSRF + XSS атаку для обеих уязвимостей. Причём это persistent XSS уязвимости. XSS: Эксплоит 1:...
PR07-26: Persistent XSS on Aruba 800 Mobility Controller's login page
Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/...
ProCheckUp Security Advisory 2007.26
Date Found: 17th July 2007 Vendor informed: 23rd July 2007 Confirmed by vendor: 13th September 2007 Description: Aruba 800 is vulnerable to a persistent XSS on the administrator login screen. An unauthenticated user can re-write the hidden parameter 'url' by requesting a link under the /screens/...
phpmyadmin -- cross-site scripting vulnerability
The DigiTrust Group reports: When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since dbcreate.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when...
GLSA-200709-18 : Bugzilla: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200709-18 Bugzilla: Multiple vulnerabilities Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs CVE-2007-4543. The next two vulnerabiliti...