Eleanor CMS rc5 Cross Site Scripting / SQL Injection

================================= Vulnerability ID: HTB22912 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectionsineleanorcms.html Product: Eleanor CMS Vendor: Eleanor CMS http://eleanor-cms.ru/ Vulnerable Version: rc5 Vendor Notification: 22 March 2011 Vulnerability Type: SQL Injecti...

Feng Office 1.7.3.3 CSRF Vulnerability

Exploit for php platform in category web applications Product: Feng Office Vendor: Secure Data SRL http://www.fengoffice.com/ Vulnerable Version: 1.7.3.3 and probably prior versions Vendor Notification: 17 March 2011 Vulnerability Type: CSRF Cross-Site Request Forgery Risk level: Low Credit:...

Hacker group defies U.S. law, defends exposing McAfee vulnerabilities !

The hacker group that exposed holes in McAfee's website knows it's breaking U.S. law, but vows to continue exposing vulnerabilities, especially on security vendor websites. The hacker group that exposed holes in McAfee's website knows it's breaking U.S. law, but vows to continue exposing...

HTB22931: XSS vulnerability in InTerra Blog Machine

Vulnerability ID: HTB22931 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityininterrablogmachine.html Product: InTerra Blog Machine Vendor: InTerra Blog Machine Team http://code.google.com/p/interra/ Vulnerable Version: 1.84 and probably prior versions Vendor Notification: 31 March 2011...

Fedora 13 : wordpress-3.1-1.fc13 (2011-3738)

In order to protect against two CVEs, I'm upgrading Wordpress in all releases to 3.1. In addition, this will obsolete wordpress-mu, since this functionality has been migrated to the main wordpress release as of wordpress 3.0, and wordpress-mu has been deprecated upstream. I would not normally mak...

mvmmall shop Mall system, the latest injection vulnerability and fix(search.php)-vulnerability warning-the black bar safety net

mvmmall shop Mall system, the latest injection 0day issues out in the search search. php this file. The code is as follows: ? php requireonce ‘include/common.inc.php’; requireonce ROOTPATH.’header.php’; if$action!=’ search’ $searchkey = ”; if isset$pssearch //Omitted a bunch of stuff $tagids =...

CAT – Web Application Security Test & Assessment Tool

CAT is designed to facilitate manual web application penetration testing for more complex, demanding application testing tasks. It removes some of the more repetitive elements of the testing process, allowing the tester to focus on individual applications, thus enabling them to conduct a much mor...

The Open Pentest Bookmark Collection v1.4

We are pleased to announce the release of version 1.4 yes 1.3 squeaked by without a blog post of the Open Pentest Bookmarks Collection. They have added a large amount of community submissions, with the addition of severalnew sections. They have also moved around some of the bookmarks to better...

SyndeoCMS 2.8.02 - Multiple Vulnerabilities (2)

SyndeoCMS 2.8.02 - Multiple Vulnerabilities 2 Vulnerability ID: HTB22901 Reference: http://www.htbridge.ch/advisory/sqlinjectioninsyndeocms.html Product: SyndeoCMS Vendor: http://www.syndeocms.org/ http://www.syndeocms.org/ Vulnerable Version: 2.8.02 Vendor Notification: 10 March 2011 Vulnerabili...

Ripe Website Manager 1.1 XSRF / XSS / SQL Injection

================================ Vulnerability ID: HTB22898 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinripewebsitemanager.html Product: Ripe website manager Vendor: Ripe website manager Team http://www.ripewebsitemanager.com/ Vulnerable Version: 1.1 and probably prior versions Vendor...

SyndeoCMS 2.8.02 XSS / Path Disclosure / SQL Injection

================================= Vulnerability ID: HTB22899 Reference: http://www.htbridge.ch/advisory/pathdisclosureinsyndeocms.html Product: SyndeoCMS Vendor: http://www.syndeocms.org/ http://www.syndeocms.org/ Vulnerable Version: 2.8.02 Vendor Notification: 10 March 2011 Vulnerability Type:...

EC-Council News : Advanced Security Training First Look !

EC-Council News : Advanced Security Training First Look ! Information technology continues to rapidly evolve and as the dependence on Internet technology increases, so are the risks to information systems. As such, information security professionals are required to stay up-to-date on the latest...

Anti-injection program to get a shell and fix-vulnerability warning-the black bar safety net

When you use single quotes“’”to test a website there may be injection vulnerability in the address, assuming the URL is“www.xxxx/news.asp?id=6”pop“your operation has been recorded!” Such information, and we can't go to bypass anti-injection system, you can try to submit http://www. xxxx/sqlin. as...

Mc.Graw Hill – Hacking Exposed 3rd Edition 2011

The latest Web app attacks and countermeasures from world-renowned practitioners. Protect your Web applications from malicious attacks by mastering the weapons and thought processes of today's hacker. Written by recognized security practitioners and thought leaders, Hacking Exposed Web...

Security Event : Hack In Paris (16-17 June, 2011)

Security Event : Hack In Paris 16-17 June, 2011 Hack In Paris is an international and corporate security event that will take place in Disneyland Paris® fromJune 16th to 17th of 2011. Please refer to the homepage to get up-to-date information about the event. Topics The following list contains...

Fox Sitcom Will Depict Pen Testing Firm

Hollywood is taking another crack at hacker culture – this time with a decidedly contemporary twist: a sitcom that will depict the zany doings of a group of security geeks who work as corporate penetration testers. The new show, breakingin, is scheduled to debut on April 6 and will star Christian...

HTB22889: XSS in Rating-Widget wordpress plugin

Vulnerability ID: HTB22889 Reference: http://www.htbridge.ch/advisory/xssinratingwidgetwordpressplugin.html Product: Rating-Widget wordpress plugin Vendor: Vova Feldman http://rating-widget.com/ Vulnerable Version: 1.3.1 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site...

HTB22890: XSS in Rating-Widget wordpress plugin

Vulnerability ID: HTB22890 Reference: http://www.htbridge.ch/advisory/xssinratingwidgetwordpressplugin1.html Product: Rating-Widget wordpress plugin Vendor: Vova Feldman http://rating-widget.com/ Vulnerable Version: 1.3.1 Vendor Notification: 03 March 2011 Vulnerability Type: XSS Cross Site...

LotusCMS 3.0.3 - Multiple Vulnerabilities

Vulnerability ID: HTB22886 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: CSRF Cross-Site Request...

HTB22888: File Content Disclosure in LotusCMS

Vulnerability ID: HTB22888 Reference: http://www.htbridge.ch/advisory/filecontentdisclosureinlotuscms.html Product: LotusCMS Vendor: Arboroia Network http://www.lotuscms.org/ Vulnerable Version: 3.0.3 and probably prior versions Vendor Notification: 01 March 2011 Vulnerability Type: File Content...