CVE-2012-5652

CVE-2012-5652 affects Drupal 6.x prior to 6.27, allowing remote attackers to disclose sensitive information about uploaded files via RSS feeds or search results. Root cause involves information disclosure in output for file-related data; no exploitation details are provided in the sources. The vu...

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

PT-2013-1823

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 6.27 Description The issue allows remote attackers to obtain sensitive information about uploaded files. This can be achieved via a RSS feed or search result. Recommendations For versions prior to 6.27, update to versi...

CVE-2012-5652: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

PT-2012-5055

Name of the Vulnerable Software and Affected Versions Open Constructor version 3.12.0 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several parameters, including the result...

MyBB User Profile Skype ID Plugin 1.0 - Persistent Cross-Site Scripting

MyBB User Profile Skype ID Plugin 1.0 - Persistent Cross-Site Scripting Exploit Title: Profile Skype ID MyBB Plugin Stored XSS Date: 14/12/2012 Exploit Author: limb0 Vendor Homepage: http://www.dragonknightz.net/ Software Link: http://mods.mybb.com/view/user-profile-skype-id Version: 1.0...

Gazine2 Cross Site Scripting

---------------------------------------------------------------- Gozine2 alert/0/ www.gozineyejavan.ir/modules.php?name=ResultCards&op=ResultCards&FieldID=&Year=alert/0/ www.gozine2.co/modules.php?name=ResultCards&op=ResultCards&FieldID=&Year=alert/0/ GreetZ To : | Am!r | B3HZ4D |...

Snort 2 - DCE/RPC Preprocessor Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Snort 2 DCE/RPC preprocessor Buffer...

ManageEngine Device Expert 5.6 Directory Traversal

ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Database Backup / auth-conf.xml Disclosure Exploit product homepage: http://www.manageengine.com/products/device-expert/ file tested: ManageEngineDeviceExpert.exe tested against:...

ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability. EMC Identifier: ESA-2012-010 EMC Identifier: SRCH-7949 CVE Identifier: CVE-2012-0396 Severity Rating: CVSS v2 Base Score: 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N Affected products: EMC S...

EMC Documentum xPlore information leakage

Under specific circumstances, an authenticated user who does not have BROWSE permission on the object may be able to see the existence of or certain metadata on that object in a search result...

CVE-2010-4947

Cross-site scripting XSS vulnerability in advancedsearchresult.php in ALLPC 2.5 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter...

CVE-2011-2705

The SecureRandom.randombytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an...

esp cms injection 0day-vulnerability warning-the black bar safety net

In urldecode the role of the non-filtered result in injection form interface/search.php ---- intaglist ---- $tagkey（ Urldecdoe after processing directly into SQL statement, the injection formedcode omitted Test: http://localhost/espcms/index.php?ac=search&at=taglist&tagkey=dd%2 5 2 7,%2527dd%2 5 ...

HAM3D Shop Engine Shell Upload

found by : d3c0der - h3x + HAM3D Shop Engine remot file upload Vulnerability + Portal Name : HAM3D Shop Engine + software : http://ham3d.net/shop.html + found by : d3c0der , h3x + Contact : [email protected] , [email protected] + special tnx : attackerz.ir , phc.ir , security-war.ir...

CVE-2011-0019

slapd aka ns-slapd in 389 Directory Server 1.2.7.5 aka Red Hat Directory Server 8.2.x or dirsrv does not properly handle simple paged result searches, which allows remote attackers to cause a denial of service daemon crash or possibly have unspecified other impact via multiple search requests...

PT-2011-2017

Name of the Vulnerable Software and Affected Versions 389 Directory Server version 1.2.7.5 Description The issue is related to the handling of simple paged result searches by the slapd component in 389 Directory Server. This can be exploited by remote attackers to cause a denial of service,...

CVE-2011-0019: Improper Input Validation

slapd aka ns-slapd in 389 Directory Server 1.2.7.5 aka Red Hat Directory Server 8.2.x or dirsrv does not properly handle simple paged result searches, which allows remote attackers to cause a denial of service daemon crash or possibly have unspecified other impact via multiple search requests...

2DayBiz Job Site Script - SQL Injection

$------------------------------------------------------------------------------------------------------------------- $ 2daybiz Job site Script SQL injection $ Author : Sangteamtham $ Home : Hcegroup.net $ Download :http://www.2daybiz.com/realestateportalscript.html $ Date :06/24/2010 $ $ $Exploit...