XSS in communityserver !

hey guys .. check out this new xss i just found ;P Vulnerable : communityserver Commercial edition web : http://communityserver.org/ XSS : http://localhost/path/search/SearchResults.aspx?q=223e3cscript3ealert27bl4ck273c2fscript3e&o=Relevance Discovered By BLacK ZeRo [email protected] Best regards...

berlios.meta.txt

package Msf::Exploit::gpsdformatstring; use base "Msf::Exploit"; use strict; use Pex::Text; use IO::Socket; my $advanced = ; my $info = 'Name' = 'Berlios GPSD Format String Vulnerability', 'Version' = '$ 1.0 $', 'Authors' = 'Enseirb ', , 'Arch' = 'x86' , 'OS' = 'linux' , 'Priv' = 1, 'UserOpts' =...

EUVD-2006-5757

Directory traversal vulnerability in index.php in FreeWebshop 2.2.1 and earlier allows remote attackers to read arbitrary files and disclose the installation path via a .. dot dot in the action parameter...

MHL-2006-003 Public Advisory: "ezOnlineGallery" Multiple Security Issues

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MHL-2006-003 - Public Advisory +-----------------------------------------------------------+ | ezOnlineGallery Multiple Security Issues | +-----------------------------------------------------------+ PUBLISHED ON October 26th, 2006 PUBLISHED AT...

[SECURITY] [DSA 1176-1] New zope2.7 packages fix information disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 1176-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 13th, 2006 http://www.debian.org/security/faq -...

Multible injections and vulnerabilities in Jetbox CMS

Hello,, Multible Injections in Jetbox CMS Discovered By : HACKERS PAL & mohajali Copy rights : HACKERS PAL & mohajali Website : http://www.soqor.net Email Address : [email protected] This Contains multible injections and vulnerabilities in Jetbox CMS // sql injections if magicquotesgpc = off...

[Full-disclosure] ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability

ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-025.html July 26, 2006 -- CVE ID: CVE-2006-3677 -- Affected Vendor: Mozilla -- Affected Products: Firefox 1.5.0 - 1.5.0.4 SeaMonkey 1.0 - 1.0.2 -- TippingPointTM IPS Customer...

Webmin 1.290 Usermin 1.220 - Arbitrary File Disclosure (Perl)

Webmin 1.290 Usermin 1.220 - Arbitrary File Disclosure Perl !/usr/bin/perl Exploit for WEBMIN and USERMIN less than 1.29x ARBITARY REMOTE FILE DISCLOSURE WORKS FOR HTTP AND HTTPS NOW Thrusday 13th July 2006 Vulnerability Disclosure at securitydot.net Coded by UmZ! umz32.dll at gmail.com Make sure...

papoo3rc3.php.txt

!/usr/bin/php -q -d shortopentag=on ? echo "PAPOO = 3RC3 SQL injection / admin credentials disclosure\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Help Contact Imprint Sitemap" | "powered by papoo" | "powered by cms papoo"\n\n"; / notes:...

[Full-disclosure] Cpanel Admin login (username) Disclosure

Hi, could somebody kindly confirm this. When a null username and a null password is provided in the cpanel administration, port 2082, basic authorization prompt and then cancelling the prompt the second time, the webpage presents a hyperlink to reset the password which contains valid username for...

xfocus-SD-060101.txt

Title:xfocus-SD-060101AIX getCommand&getShell two vulnerabilities Affected version : aix5.3 ml03,Other versions not test, should also be affected. Vendor: http://www.ibm.com/ Where: Local XFOCUS http://www.xfocus.org had already discovered some vulnerabilities in getCommand&getShell. After apply...

waraxe-2005-SA043.txt

================================================================================ waraxe-2005-SA043 ================================================================================ Sql injection in Phorum 5.0.20 and earlier...

[Full-disclosure] ClamAV Multiple Rem0te Buffer Overflows

Date July 25, 2005 Vulnerability ClamAV is the most widely used GPL antivirus library today. It provides file format support for virus analysis. During analysis ClamAV Antivirus Library is vulnerable to buffer overflows allowing attackers complete control of the system. These vulnerabilities can ...

e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure

/ 1 Change milw0rm.com to your domain.com 2 Post the below code into a new message. Credits to Nick Griffin. /str0ke /...

e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure

e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure / 1 Change milw0rm.com to your domain.com 2 Post the below code into a new message. Credits to Nick Griffin. /str0ke /...

FreeBSD : squid -- possible information disclosure (f0db930b-496b-11d9-bf86-0050569f0001)

The squid-2.5 patches pages notes : In certain conditions Squid returns random data as error messages in response to malformed host name, possibly leaking random internal information which may come from other requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

YAWS < 1.56 Script File Source Code Disclosure

Binary data 3019.prm...

Firescrolling 2 [Firefox 1.0.1&#41;

Summary Even though Firefox 1.0.1 patched one of the key bugs behind my firescrolling exploit the ability of plugins to load chrome files in a hidden frame the ability to hijack a drag and drop operation and open a privileged xul file is still available. The demo opens...

CubeCart 2.0.x - 'tellafriend.php?product' Full Path Disclosure

source: https://www.securityfocus.com/bid/13050/info CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. These issues affect the 'index.php',...

RE: Reading local files in Netscape 6 and Mozilla &#40;GM#001-NS&#41;

Disturbing. Netscape sure must be in financial problems since they are selling out on their users security for a lousy $1000. I know for one that I personally will release any future Netscape advisories with full public disclosure and without prior Netscape notification. As a matter of fact, why...