Multiple vulnerabilities in TYPO3 Core

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting XSS, Open Redirection, SQL Injection, Broken Authentication and Session Management, Insecure Randomness, Information Disclosure, Arbitrary Code Execution Component Type: TYPO3 Core Affected Versions: 4.1.13 and below,...

FreeBSD : joomla -- multiple vulnerabilities (8d10038e-515c-11df-83fb-0015587e2cc1)

Joomla! reported the following vulnerabilities : If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system.. The migration script in the Joomla! installer does not check the file type being uploaded. If the installation...

Zyke CMS 1.1 - Authentication Bypass

Zyke CMS 1.1 - Authentication Bypass ====================================================== ZykeCMS V1.1 Auth Bypass SQL Injection Vulnerability ====================================================== Author : Giuseppe 'giudinvx' D'Inverno Email : Date : 04-16-2010 Site :...

CVE-2009-4509: TANDBERG VCS Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: TANDBERG Video Communication Server Authentication Bypass Release Date:...

PHP 5.2.12 / 5.3.1 safe_mode / open_basedir Bypass

PHP 5.2.12/5.3.1 session.savepath safemode and openbasedir bypass Credit: Grzegorz Stachowiak Provided by: SecurityReason.com Date: - Written: 31.01.2010 - Public: 11.02.2010 SecurityRisk: Medium Affected Software: PHP 5.2.12 PHP 5.3.1 Advisory URL:...

Authentication flaw

The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser...

Cybershade CMS 0.2 - Remote File Inclusion

Cybershade CMS 0.2 - Remote File Inclusion Author: Author: Mr.SeCreT E-mail: [email protected] From: Syria Script Information: Script: Cybershade CMS 0.2 Remote File Inclusion Vulnerability Language: PHP Download:...

Oracle eBusiness Suite Cross Site Scripting / Bypass

Hacktics Research Group Security Advisory http://www.hacktics.com/details=;view=Resources%7CAdvisory By Shay Chen, Hacktics. 14-Dec-2009 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, certain vulnerabilities were identified in the Oracle eBusiness...

OWASP Con Begets Top 10 Threats List

Injection attacks top the 2010 OWASP Top 10 list of Web application security threats, including SQL, OS, and LDAP injection, followed by cross-site scripting XSS, broken authentication and session management, insecure direct object references, cross-site request forgery CSRF, security...

CubeCart 4 Session Management Bypass

CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software solution, designed to allow individuals...

CubeCart 4 - Session Management Bypass

CubeCart 4 - Session Management Bypass CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software...

CubeCart 4 - Session Management Bypass

CubeCart 4 Session Management Bypass Release Date: 2009/10/29 Author: Bogdan Calin bogdan at acunetix dot com Severity: Critical Vendor Status: Vendor has released an updated version I. Background From Wikipedia: CubeCart is a free-to-use eCommerce software solution, designed to allow individuals...

CubeCart 4 Session Management Bypass

Exploit for unknown platform in category web applications ==================================== CubeCart 4 Session Management Bypass ==================================== CubeCart 4 Session Management Bypass Severity: Critical Vendor Status: Vendor has released an updated version I. Background From...

openSUSE Security Update : xrdp (xrdp-443)

This update fixes multiple buffer overflows that can be exploited remotely to execute arbitrary code. Additionally xrdp does not register remote session as local anymore. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

Arab Portal 2.2 - Authentication Bypass

Arab Portal 2.2 - Authentication Bypass Script Name : Arab portal 2.2 Remote Auth SQL Bypass Vulnerabilitiy Script home : http://www.arab-portal.info/arabportal22.zip Exploit risk level : High Found By : RoMaNcYxHaCkEr RXH Written By : Sniper Code S.C.T - 443 Our home : WwW.Sec-Code.CoM Security ...

CVE-2009-1634

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors...

Session fixation

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors...

CVE-2009-1634

The CVE-2009-1634 affects the WebAccess component in Novell GroupWise 7.x (before 7.03 HP3) and 8.x (before 8.0 HP2). It arises from improper session management, allowing remote attackers to gain access to user accounts via unspecified vectors. According to NVD, the vulnerability has CVSSv2 base ...

CVE-2009-1634

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors...

glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql injection exploit

?php / glFusion = 1.1.2 COMapplyFilter/cookies remote blind sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.glfusion.org/ google dork: "Page created in" "seconds by glFusion" +RSS Found another vector of injection in...