CVE-2011-2677

Cybozu Office before 8.0.0 is affected by an improper access control vulnerability where remote authenticated users can bypass restrictions and access sensitive information (time card and attendance) by manipulating a URL. Affected product: Cybozu Office (pre-8.0.0). Root cause: insufficient enfo...

Microsoft Lync 4.0.7577.0 Javascript Injection

============================================================================ Foofus.net Security Advisory: foofus-20110610 ============================================================================ Title: Javascript Injection in Microsoft Lync Version: 4.0.7577.0 Vendor: Microsoft Release Date:...

Wordpress plugin Comment Rating Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin Comment Rating more than once in url Date: 14-03-2011 Author: sasa1 mysite: www.dev-chat.com Vendor: http://wealthynetizen.com Download: http://downloads.wordpress.org/plugin/comment-rating.zip Exploit 4 Comment...

CVE-2010-3488

Directory traversal vulnerability in QuickShare 1.0 allows remote attackers to read arbitrary files via a ... triple dot in the URL...

SiteGenius CMS Blind SQL Injection

Exploit Title: SiteGenius CMS Blind SQL Injection Vulnerabilities Date found: 7.2010 Author: MikiSoft Email: [email protected] CMS Software Site/Link: http://www.webtopsolutions.net, http://www.hostingcms.ch/home/index.php?p=143 CMS Info.: SiteGenius 2002 is framework for business excellence...

Directory traversal

Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the url parameter. NOTE: the researcher also suggests an analogous PHP remote file inclusion vulnerability, but this may be incorrect...

New Bug Found By Ostoure Sazan Sharif

www.Ostoure.com | | Ostoure Security Research Team | | Title: Accounting Portal authentication Bypass | Vendor: Parsonline - Parsway ISP | Exploitation: Remote with browser ==================== - Description: ==================== The data in the admin folder "DesktopModules" can be accessed via a...

BaBB 2.8 Remote Code Injection Exploit

Exploit for unknown platform in category web applications ====================================== BaBB 2.8 Remote Code Injection Exploit ====================================== !usr/bin/python BaBB 2.8 Full Code Injection Exploit Download :...

Ann can resolution I is male and female it?-- Keep track of the same shape word attack techniques-vulnerability warning-the black bar safety net

An attacker in order to achieve the attack purpose, they in the network link can be described under the foot work: in order to convince the user to click a link, find ways to make these links look a bit of a problem are not, however, as long as the user clicks on to be brought into the...

FreeBSD : opera -- multiple vulnerabilities (225bc349-ce10-11dd-a721-0030843d3802)

The Opera Team reports : Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code. Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be...

Openfire Server 3.6.0a - Authentication Bypass SQL Injection Cross-Site Scripting

Openfire Server 3.6.0a - Authentication Bypass SQL Injection Cross-Site Scripting Advisory: Openfire Server Multiple Vulnerabilities Advisory ID: AKADV2008-001 Release Date: 2008/11/07 Revision: 1.0 Last Modified: 2008/11/07 Date Reported: 2008/05/17 Author: Andreas Kurtz mail at andreas-kurtz.de...

calendars-bypass.txt

Exploit discovered by SecVuln from http://secvuln.com Come join our clan! contact [email protected] Author == SecVuln Version == 4.02 Software == Calendars for the web by great hill corporation Calendars for the web has a vulnerability in the administration page. The page saves the past session...

FreeBSD : py-pylons -- Path traversal bug (f5c58fc1-49c0-11dd-b0ba-00163e000016)

Pylons team reports : The error.py controller uses paste.fileapp to serve the static resources to the browser. The default error.py controller uses os.path.join to combine the id from Routes with the media path. Routes prior to 1.8 double unquoted the PATHINFO, resulting in FileApp returning file...

Vulnerability in Network General/Net Scout product

Network General Enterprise Administrator Network General has been aquired by Net Scout: Non-privileged users can perform privileged functions by manipulating the URL. Can log on as user and using the following URL conduct administrative functions:...

netscout-admin.txt

Network General Enterprise Administrator Network General has been aquired by Net Scout: Non-privileged users can perform privileged functions by manipulating the URL. Can log on as user and using the following URL conduct administrative functions:...

CVE-2008-2220

CVE-2008-2220 affects Interact Learning Community Environment Interact 2.4.1. The vulnerability arises when register_globals is enabled and enables remote PHP code execution via remote file inclusion. Specifically, an attacker can supply a URL via CONFIG[LANGUAGE_CPATH] to modules/forum/embedforu...

Blog PixelMotion (index.php categorie) SQL Injection Vulnerability

No description provided by source. Blog Pixel Motion Sql Injection Vulnerability ------------------------------------------------------------------------------------------------- Author : parad0x Home : www.inso.host.sk Script : Blog PixelMotion Download : http://www.pixelmotion.org/zip/blog.zip...

TRUC 0.11.0 (download.php) Remote File Disclosure Vulnerability

No description provided by source. TRUC 0.11.0 download.php Remote File Disclosure Vulnerability http://switch.dl.sourceforge.net/sourceforge/truc/truc0.11.0.tar.gz POC : /download.php?uploadfilename=configinc.php /download.php?uploadfilename=../../../../../../../../etc/passwd Dork : TRUC 0.11.0 ...

Code injection

BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a 1 + plus, 2 . dot, or 3 %80 and similar characters to the file name in the URL...

CVE-2007-6314

BarracudaDrive Web Server before 3.8 allows remote attackers to read the source code for web scripts by appending a 1 + plus, 2 . dot, or 3 %80 and similar characters to the file name in the URL...