CVE-2014-2231

Cross-site scripting XSS vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title...

WordPress BSK PDF Manager 1.3 Cross Site Scripting

============================================================== Title ...| XSS in BSK PDF Manager Version .| bsk-pdf-manager 1.3 Date ....| 23.02.2014 Found ...| HauntIT Blog Home ....| http://wordpress.org/plugins/ ==============================================================...

WordPress Kiddo Theme "uploadify.php"任意文件上传漏洞

WordPress Kiddo是WordPress的儿童主题。 WordPress Kiddo的/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php脚本允许上传任意扩展名的文件到webroot的文件夹内，如果上传的文件包含恶意PHP脚本，即可导致执行任意PHP代码。 0 WordPress Kiddo 1.x 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Fedora 20 : ikiwiki-3.20140125-1.fc20 (2014-1747)

Update to the latest stable version. Changes in ikiwiki 3.20140125 : - inline: Allow overriding the title of the feed. Closes: http://bugs.debian.org/735123 Thanks, Christophe Rhodes - osm: Escape name parameter. Closes: http://bugs.debian.org/731797 Changes in ikiwiki 3.20140102 : - aggregate:...

Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the link-to helper means that any user-supplied data bound to the link-to helper's title attribute will not be escaped...

CVE-2013-1466

Multiple cross-site scripting XSS vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the 1 subject parameter to profiles.php; 2 address1, 3 address2, 4 calendartype, 5 city, 6 state, 7 title, 8 url, or 9 zipcode parameter to...

CVE-2013-0177

Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...

PCMan FTP Server 2.07 - 'CWD' Remote Buffer Overflow

Exploit Title: PCMAN FTP 2.07 CWD Command Buffer Overflow Date: Jan 25,2014 Exploit Author: Mahmod Mahajna Mahy Version: 2.07 Tested on: Windows 7 sp1 x64 english Email: [email protected] import socket as s from sys import argv iflenargv != 4: print "USAGE: %s host " % argv0 exit1 else: store...

Oracle Outside In MDB - File Parsing Stack Buffer Overflow (PoC)

!/usr/bin/python Exploit Title: Oracle Outside In MDB File Parsing Stack Based Buffer Overflow PoC Date: 16th January 2014 PoC Author: Citadelo Vendor Homepage: http://www.oracle.com Software Link: http://www.oracle.com/us/technologies/embedded/025613.htm Version: = 8.4.1.52 and 8.4.0.108 CVE :...

CVE-2013-7175

Multiple SQL injection vulnerabilities in Avanset Visual CertExam Manager 3.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 Title, 2 File name, or 3 Candidate Name field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 file title to accounts/admin/index.php or 3 comment parameter in the support page to accounts/index2.php...

SoapUI 4.6.3 - Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits Exploit Title: SoapUI Remote Code Execution Date: 25.12.13 Exploit Author: Barak Tawily Vendor Homepage: http://www.soapui.org/ Software Link: http://www.soapui.org/Downloads/download-soapui-pro-trial.html Version: vulnerable before 4.6.4...

CVE-2013-7274

Cross-site scripting XSS vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitrary web script or HTML via the title field in a wallpaper file upload...

Cross site scripting

Cross-site scripting XSS vulnerability in Wallpaper Script 3.5.0082 allows remote authenticated users to inject arbitrary web script or HTML via the title field in a wallpaper file upload...

SiteServer 3.6.4 background_thread.aspx SQL注入漏洞

SiteServer 3.6.4 /siteserver/bbs/backgroundthread.aspx 文件Title参数没有合适过滤，导致SQL注入漏洞。 0 SiteServer 3.6.4 升级到官方最新版： http://www.siteserver.cn...

Wallpaper Script 3.5.0082 - Persistent Cross-Site Scripting

Exploit Title : Wallpaper Script Stored XSS Vulnerability D0rk Google : Author : nullp0int3r [email protected] Version : 3.5.0082 Date : 2013-12-14 Vendor Homepage: http://www.wallpaperscript.com/ Test on : Windows Exploitation: 1 Register and log on as a regular member 2 Click on "Add...

OpenJDK: insufficient escaping of window title string (Javadoc, 8016675)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and JavaFX 2.2.40 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Javadoc...

ALLPlayer 5.7 - '.m3u' UNICODE Buffer Overflow (SEH)

!/usr/bin/perl Exploit Title: ALLPlayer 5.7 .m3u - SEH Buffer Overflow Unicode Date: 11-23-2013 Exploit Author: Mike Czumak Tv3rn1x -- @SecuritySift Vulnerable Software: ALLPlayer 5.7 Software Link: http://www.allplayer.org/download/allplayer Version: 5.7 Tested On: Windows XP SP3 and Windows 7 P...

WordPress Elemin Shell Upload

Exploit Title : Wordpress Themes Elemin Arbitrary File Upload Vulnerability Author : ReC0ded Vendor : http://themify.me/ Download : http://themify.me/themes/Elemin Date : 22, November 2013. Type : php, html, htm, asp, etc. Category : Web Applications Vulnerability : File Upload Tested On : Window...

ImpressPages CMS 3.8 - Persistent Cross-Site Scripting

ImpressPages CMS 3.8 - Persistent Cross-Site Scripting Exploit Title:stored vulnerability Author: sajith version: ImpressPages CMS v3.8 vulnerable app link:http://www.impresspages.org/download/ steps: 1 log into the admin panel http://127.0.0.1/cms/ImpressPages/?cmsaction=manage 2click on advance...