2169 matches found
VTLS Virtua InfoStation.cgi - SQL Injection
=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...
VTLS-Virtua SQL Injection
=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...
WordPress custom-contact-forms Plugin SQL Upload
The WordPress custom-contact-forms plugin use auxiliary/admin/http/wp/customcontactforms msf undefinedcustomcontactforms show actions ...actions... msf undefinedcustomcontactforms set ACTION msf undefinedcustomcontactforms show options ...show and set options... msf undefinedcustomcontactforms ru...
SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability
No description provided by source. SetSeed CMS 5.8.20 loggedInUser Remote SQL Injection Vulnerability Vendor: SetSeed Product web page: http://www.setseed.com Affected version: 5.8.20 Summary: SetSeed is a self-hosted CMS which lets you rapidly build and deploy complete websites and online stores...
Oracle HTML DB 1.5/1.6 f p Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15031/info Oracle HTML DB is prone to cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affecte...
MySQL 5.0.x Single Row SubSelect Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22900/info MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata. An attacker can exploit this issue to crash the application, denying access ...
MySQL 5.0.x - IF Query Handling Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/23911/info MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries. An attacker can exploit this issue to crash the application, denying access to legitimate...
Oracle HTML DB 1.5/1.6 wwv_flow.accept p_t02 Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15031/info Oracle HTML DB is prone to cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affecte...
Oracle 10g Database SUBSCRIPTION_NAME Remote SQL Injection Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/13236/info Oracle database is prone to an SQL-injection vulnerability because the software fails to properly sanitize user-supplied data. The 'SUBSCRIPTIONNAME' parameter is vulnerable. Packages that employ this parameter...
Theeta CMS (Cross Site Scripting,SQL Injection) Multiple Vulnerabilities
No description provided by source. / \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ Theeta CMS Cross Site Scripting,SQL Injection Multiple Vulnerabilities...
Revive Adserver 'www/delivery/axmlrpc.php' 'what' Parameter SQL Injection
The Revive Adserver install hosted on the remote web server is affected by a SQL injection vulnerability because the 'www/delivery/axmlrpc.php' script fails to properly sanitize user-supplied input passed to the 'what' parameter. This can allow a remote, unauthenticated attacker to execute...
苹果CMS SQL注入一枚无视GPC,无视内置360防护脚本,无视太多..第一发
简要描述： RTRT,开个玩笑罢了 详细说明： 先来看看首页index.php location.href='install.php';';exit; require"inc/conn.php"; requireMACROOT.'/inc/common/360safe3.php';//好恐怖，内置了360,不过对后面的注入没有影响 $m = be'get','m';//这个地方会转义一次，但对我们也没影响 ifstrpos$m,'.' $m = substr$m,0,strpos$m,'.'; $par = explode'-',$m; $parlen = count$par; $ac...
GLSA-201406-10 : lighttpd: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201406-10 lighttpd: Multiple vulnerabilities Multiple vulnerabilities have been discovered in lighttpd. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could create a Denial of Service...
lighttpd: Multiple vulnerabilities
Background lighttpd is a lightweight high-performance web server. Description Multiple vulnerabilities have been discovered in lighttpd. Please review the CVE identifiers referenced below for details. Impact A remote attacker could create a Denial of Service condition. Futhermore, a remote attack...
The Lesson of eBay
After every major cyber breach, security professionals are asked about the lessons we can learn from them. While the technical details of the eBay attack arent yet public, we can already learn lessons about from companys public statements and its communications to its customers...
Threat Outbreak Alert: Fake Bank Statements Notification Email Messages on May 29, 2014
Medium Alert ID: 34416 First Published: 2014 May 29 18:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank statements for the recipient. The text in the email message attempts to convince the recipient to open the...
Design/Logic Flaw
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role...
CVE-2014-0786 Ecava IntegraXor Information Exposure
Ecava IntegraXor before 4.1.4393 allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role...
CVE-2014-0786
CVE-2014-0786 affects Ecava IntegraXor SCADA Server prior to 4.1.4393. The issue is an improper privilege/guest access flaw that allows remote attackers to read cleartext administrative credentials via SELECT statements executed with the guest role, leading to information disclosure. Affected pro...
