BigAntSoft BigAnt IM Message Server Multiple Vulnerabilities

BigAntSoft BigAnt IM Message Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PHP Support Tickets 1.9 Cross Site Scripting

Google dork: "PHP Support Tickets v1.9" inurl:index.php?action= "PHP Support Tickets v1.9" by "Triangle Solutions Ltd" allows XSS attack at index.php and some implementations also has a bad uploaded files validation allowing to upload a js with a jpg extension that could be using for bypassing XS...

Webify Photo Gallery Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications !x! Informations: Name : Webify photo gallery Download : http://webify.ws/photogallery Vulnerability : Delete Arbitrary File Vulnerability Author : JIKOJAWAD Contact : email protected Site : No-ExploiT.CoM Is Back Notes : No-ExploiT.CoM !x! Bu...

MachForm Remote Shell Upload

| @@@@@@@@ @@@@@@@@@ @@ @@ @@@@@ @@ @@ @@@@@@@@ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @@@ @ @ @ @ @ @ @ @ @ @ @ | | @@@@@@@@ @@@ @@@ @ @ @ @ @ @ @ @ @ @@@@@@@@ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @ | | @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ | | @@@@@@@@ ...

Webify Blog Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications !x! Informations: Name : Webify Blog Download : http://www.webify.ws/blog Vulnerability : Delete Arbitrary File Vulnerability Author : JIKOJAWAD Contact : email protected Site : No-ExploiT.CoM Is Back Notes : No-ExploiT.CoM Miss !x! Bug: Delet...

Tiki Wiki CMS Groupware jhot.php RCE Vulnerability

Tiki Wiki CMS Groupware is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

persistent xss vulnerability through uploaded files in IE8/9

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46953. panel It is possible to upload a number of file types checked by extension to an answers instance and then download them...

PT-2011-3239 · Microsoft +1 · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.16.4 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an uploaded file with a dangerous extension, such as .html, when accessed with a specific quer...

MultiPowUpload 2.1 Shell Upload

Exploit Title: MultiPowUpload v 2.1 Remote File Upload Vulnerability Author: DIES3L Email: [email protected] Date: 26-1-2011 Software Link: http://www.element-it.com Download Software : http://www.element-it.com/Download/ElementIT.MultiPowUpload3.zip Version: 2.1 Tested on: LiNuX...

SOOP Portal 2.0 - Arbitrary File Upload

SOOP Portal 2.0 - Arbitrary File Upload I N F O Exploit Title: SOOP Portal 2.0 Remote Upload Shell Vulnerability DDate: 05-12-2010 Author: Net.Edit0r Software Link: www.soopportal.com Version: 2.0 Tested on: windows server 2008 Contact: [email protected] [email protected] E X P L O I T 1...

Krojac CMS SQL Injection

Exploit Title: Krojach CMS SQL Injection Vulnerabilities Date found: 6.2010 Author: MikiSoft Email: [email protected] CMS Software Site/Link: http://www.krojac.com Versions affected: All Edit: In latest version this is fixed now... Google dorks: intext:"Skrojio i sašio Krojač" ; intext:"Made...

Design/Logic Flaw

Google Hack Honeypot GHH File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. CVE analysis suggests...

CVE-2008-5283

The CVE concerns Google Hack Honeypot (GHH) File Upload Manager 1.3. The vulnerability enables remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. This is stated in multiple sources, though the exact exploit vectors are not disclosed in the pro...

CVE-2008-5026

Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files aka attachments, which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting XSS attacks by uploading HTML...

Debian DSA-1488-1 : phpbb2 - several vulnerabilities

Several remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0471 Private messaging allowed cross site request forgery, making it possible to delete all private messages of...

Cross site scripting

Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting XSS in uploaded files...

CVE-2008-0381

Technical details for CVE-2008-0381 are not publicly available in the provided documents. No concrete affected versions, root cause, or fixes are specified beyond generic cross-site scripting in uploaded Mahara files. Monitor for updates.

CVE-2008-0381

Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting XSS in uploaded files...

Design/Logic Flaw

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...