Fedora 17 : wordpress-3.5.1-1.fc17 (2013-1692)

WordPress 3.5.1 is now available. Version 3.5.1 is the first maintenance release of 3.5, fixing 37 bugs. It is also a security release for all previous WordPress versions. Which include : - Editor: Prevent certain HTML elements from being unexpectedly removed or modified in rare cases. - Media: F...

Angel (4d0r4b13) help Admin to fix vulnerabilities of Website !

Angel 4d0r4b13 help Admin to fix vulnerabilities of Website ! Mr. Nitin , owner of websites https://www.lohchab.in/ and https://site2sms.com/ has email us and inform that recently his website was got hacked and after that Mr. Angel 4d0r4b13 , an Indian Hacker help him to find and Patch...

Альтернативный LIMIT

Затравка. Приведу альтернативу LIMIT, когда в url нельзя использовать символы: пробел,,',/,% Из-за ограничений отпадают альтернативные пробелы %09,%0A,... и //. Остается альтернативный синтаксис с использованием скобок. Но синтаксис limit не позволяет даже их: Код: ... limit1,100 -- error...

Limny 2.0 - Cross-Site Request Forgery (Change Email and Password)

Limny 2.0 - Cross-Site Request Forgery Change Email and Password /¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯\ :Limny 2.0 Change Pass CSRF : / /Discovered By: \ |Luis Santana | / Overview ¯¯¯¯¯¯¯¯¯¯ The Limny 2.0 CMS is vulnerable to a Cross-Site-Request Forgery exploit which allows for a malicious attacker to...

Confluence users should inherit permissions from the anonymous user

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-17278. panel This has been derived from CONF-4955|http://jira.atlassian.com/browse/CONF-4955. The above seems to have been fixe...

Is It Time to Stop Password Masking?

From SANS AppSec Street Fighter Blog Jason Montgomery I just ran across Jakob Nielsen‘s Alert Box post titled Stop Password Masking and wanted to provide some feedback from a security vs. usability perspective. I have great respect for Nielsen’s contribution to the usability of the web. Back in t...

Opera Web Browser Multiple Vulnerabilities - Dec08 (Windows)

The host is installed with Opera web browser and is prone to multiple Vulnerabilities. OpenVAS Vulnerability Test $Id: secpodoperamultvulndec08win.nasl 6519 2017-07-04 14:08:14Z cfischer $ Opera Web Browser Multiple Vulnerabilities - Dec08 Windows Authors: Chandan S Copyright: Copyright c 2008...

Sphider query Parameter Cross-Site Scripting Vulnerability

Sphider is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in Sphider 1.3.4, when the search suggestion feature is enabled, allows remote attackers to inject arbitrary web script or HTML via the query parameter, a different vector than CVE-2006-2506...

sphider134-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sphider Cross Site Scripting Vulnerability Original release date: 2008-04-29 Last revised: 2008-05-06 Latest version: http://users.own-hero.net/decoder/advisories/sphider134-xss.txt Source: Christian Holler Systems Affected: Sphider 1.3.4...

Site@School <= 2.3.10 Remote Blind SQL Injection Exploit

No description provided by source. ? / -------------------------------------------------------- Site@School = 2.3.10 Remote Blind SQL Injection Exploit -------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http:// details..: works wit...

Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================= Wordpress 2.2 xmlrpc.php Remote SQL Injection Exploit ======================================================= / El error, bastante tonto por cierto, se encuentra en la funcion...

Kerio WebStar本地权限提升漏洞

Kerio WebSTAR是运行在Mac OS X平台上的WEB服务器。 Kerio WebSTAR在不安全的权限安装程序文件，本地攻击者可能利用此提升自己的权限。 在安装Kerio WebSTAR时/Applications中继承了两个setuid二进制程序： kevin-finisterres-computer:/Desktop kf$ find /Applications/Kerio\ WebSTAR -perm -4000 -ls 978790 3016 -rwsrwx--x 1 root admin 1542556 Apr 10 2006 /Applications/Kerio...

File inclusion and XSS vulnerability in E-Store Kit-2 PayPal Edition

Dcrab 's Security Advisory http://icis.digitalparadox.org/dcrab http://www.hackerscenter.com/ Severity: High Title: File inclusion and XSS vulnerability in E-Store Kit-2 PayPal Edition Date: March 26, 2005 Summary: There are file include and xss vulnerabilities in E-Store Kit-2 PayPal Edition...

A page containing the rss-macro is not displayed if the requested rss-feed is "down"

A page containing the rss-feed macro is not shown if the requested rss-feed is "down" there's no response sent to the browser. It would certainly be better if the page could be displayed anyway; perhaps with a message stating that the feed contents can't be fetched...

GLSA-200405-04 : OpenOffice.org vulnerability when using DAV servers

The remote host is affected by the vulnerability described in GLSA-200405-04 OpenOffice.org vulnerability when using DAV servers OpenOffice.org includes code from the Neon library in functions related to publication on WebDAV servers. This library is vulnerable to several format string attacks...

l2tpd < 0.69 control.c write_packet Function Remote Overflow

The remote host is running a version of l2tpd which is older or equal to 0.68. This version is vulnerable to a buffer overflow which might allow an attacker to execute arbitrary commands on the remote host with super-user privileges. C Tenable Network Security, Inc. include"compat.inc"; if...

vbulletinSQL.txt

vBulletin Forum 2.3.xx calendar.php SQL Injection ======================================================== Website: www.safechina.net Discovered by: mslug [email protected] Description: ============= There exist a sql injection problem in calendar.php. Notice the eventid field. -------- Cut fr...

writesrv Service Detection

This service gives potential attackers information about who is connected and who isn't, easing social engineering attacks for example. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid11222; scriptversion "$Revision: 1.12 $"; scriptcvsdate"$Date: 2011/03/11 21:52:41 $"...

Have JIRA delete cookie when user authentication fails

I would like to suggest that if JIRA loads the user details id and password from a cookie and attempts to authenticate and fails then JIRA should delete the cookie. The logic behind this is: We are using LDAP for authentication to Novell's NDS and if a user gets JIRA to remember their id and...