CS Cart 1.3.3 Cross Site Scripting

Exploit Title: CS CART 1.3.3 INSTALL.PHP XSS Date: 2010-09-08 Author: LogicGate Software Link: http://cs-cart.smartcode.com/ Version: 1.3.3 Tested on: N/A CVE : N/A If "install.php" was not removed after installation simply make an html file with the following code and replace by the PATH to...

Parallels Plesk Sitebuilder Persistent Xss Vulnerability

Exploit for php platform in category web applications ======================================================== Parallels Plesk Sitebuilder Persistent Xss Vulnerability ======================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0...

[SECURITY] Fedora 11 Update: kdeedu-4.4.3-1.fc11.1

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

[SECURITY] Fedora 12 Update: kdeedu-4.4.3-1.fc12.1

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

DEBIAN-CVE-2010-1620

Integer overflow in the loadiface function in Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 might allow context-dependent attackers to execute arbitrary code via a 1 file or 2 socket that provides configuration data with many entries, leading to a heap-based buffer overflow...

DEBIAN-CVE-2010-1457

Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a 1 -c or 2 -a option, which prints file contents in an error message...

UBUNTU-CVE-2010-1457

Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a 1 -c or 2 -a option, which prints file contents in an error message...

Vbulletin - Two-Step External Link XSS

Vendor: vBulletin Affected versions: 3.7.x - 3.8.x Mod: Two-Step External Link URL: http://www.vbulletin.org/forum/showthread.php?t=217708 Vulnerability type: XSS Risk rating: Medium Exploit http://FORUM/externalredirect.php?url=XSS Bug File: externalredirect.php line 35 Code: $url =...

Vbulletin - Two-Step External Link XSS

No description provided by source. Vendor: vBulletin Affected versions: 3.7.x - 3.8.x Mod: Two-Step External Link URL: http://www.vbulletin.org/forum/showthread.php?t=217708 Vulnerability type: XSS Risk rating: Medium Exploit http://FORUM/externalredirect.php?url=XSS Bug File: externalredirect.ph...

vBulletin Two-Step External Link Module - externalredirect.php Cross-Site Scripting

vBulletin Two-Step External Link Module - externalredirect.php Cross-Site Scripting source: https://www.securityfocus.com/bid/39597/info Two-Step External Link module for vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied...

[SECURITY] Fedora 11 Update: kdeedu-4.4.2-1.fc11

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

...because you can't get enough of clickjacking

I promise to post something more interesting shortly - but in the meantime, I wanted to drop a quick note about something kinda amusing. There was a considerable amount of buzz around clickjacking 1 in the past year or so. It is commonly believed that this simple attack can only be realistically...

Remote shield the telnet service of the ntlm authentication-bug warning-the black bar safety net

A lot of people get to upload the file permissions and administrator permissions later want to start the remote tlelnet service, but met Nasty NTLM authentication, for this case, we very often use to upload files 比如 NTLM.exe and then at the remote timing of the implementation, if at hand is no su...

[SECURITY] Fedora 10 Update: kdeedu-4.3.1-1.fc10

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

[SECURITY] Fedora 11 Update: kdeedu-4.3.1-1.fc11

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

CVE-2008-6597: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-5423

Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vecto...

CVE-2003-1562

MODE C CVE-2003-1562 refers to a race condition in sshd/OpenSSH 3.6.1p2 and earlier, where with PermitRootLogin disabled and using PAM keyboard-interactive authentication, sshd does not insert a delay after a root password attempt. This timing discrepancy could enable remote attackers to infer wh...

DEV WMS Multiple Vulnerabilities

---------------------------------------------------------------- Script : DEV WMS Type : Multiple Vulnerabilities Local file inclusion / Cross Site Scripting / SQL Injection Alert : High ---------------------------------------------------------------- Discovered by : Khashayar Fereidani Or Dr.Cra...

devwms-lfisqlxss.txt

---------------------------------------------------------------- Script : DEV WMS Type : Multiple Vulnerabilities Local file inclusion / Cross Site Scripting / SQL Injection Alert : High ---------------------------------------------------------------- Discovered by : Khashayar Fereidani Or Dr.Cra...