Cross site scripting

Cross-site scripting XSS vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers VCS with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, aka Bug ID CSCts80342...

CVE-2011-3294

Cross-site scripting XSS vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers VCS with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, aka Bug ID CSCts80342...

FreeBSD : torrentflux -- User-Agent XSS Vulnerability (72f21372-55e4-11db-a5ae-00508d6a62df)

Steven Roddis reports that User-Agent string is not properly escaped when handled by torrentflux. This allows for arbitrary code insertion. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

Grand network SMS ddos attack vulnerabilities and fixes-vulnerability warning-the black bar safety net

Brief description: Grand online presence SMSddosattack vulnerability Detailed description: Grand online Forgot Password at will to the phone to send verification code, The URL: http://pwd.sdo.com/ptinfo/safecenter/getpwd/ChgPwdStepOldPwd.aspx?showbindmobile=1 Phone numbers can be arbitrarily...

Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities

The host is running Adobe ColdFusion and is prone to multiple cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodadobecoldfusionmultiplexssvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities Authors: Sooraj KS...

Adobe ColdFusion Multiple XSS Vulnerabilities (Sep 2011)

Adobe ColdFusion is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

MyAuth3 Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit Google Dork: allinurl:1881/?console=panel Date: 09/06/2011 Author: Marcio Almeida marcioatalligatorteamdot org | @marcioalm Version: 3.0 Tested on: Linux EDB-Note:...

http-joomla-brute NSE Script

Performs brute force password auditing against Joomla web CMS installations. This script initially reads the session cookie and parses the security token to perfom the brute force password auditing. It uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are...

Cross site scripting

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2011-1357

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2011-1357

Cross-site scripting XSS vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository WSRR 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

WordPress WPtouch 1.9.32 URL Redirect

Exploit Title: 0-Day WPtouch WordPress Plugin 1.9.32 URL redirection Google Dork: intext:"Powered by Wordpress + WPtouch" with iphone/android User-Agent Author: MaKyOtOx special pwet to ansx & Zizounette & antrhacks for bitcoin Date: 25/07/2011 Software Link:...

vBseo 3.1.0 Remote Command Execution

!/usr/bin/perl vBseo 3.1.0 vbseo.php vbseourl Remote Command Execution Exploit vendor: http://www.vbseo.com/ Author: Jose Luis Gongora Fernandez a.k.a JosS twitter: @JossGongora mail: joss.xroot0x40gmail0x2ecom site: http://www.hack0wn.com/ This was written for educational purpose. Use it at your...

Joomla A Cool Debate 1.0.3 Local File Inclusion

A Cool Debate 1.0.3 Component Joomla Local File Inclusion ========================================================================================= - Discovered by : Chip D3 Bi0s - Email : chipdebiosatgmaildotcom - Group : LatinHackTeam - Date : 18 june 2011 - Where : From Remote...

Nmap NSE net: http-brute

Performs brute force password auditing against http basic authentication. SYNTAX: brute.firstonly: stop guessing after first password is found default: false brute.unique: make sure that each password is only guessed once default: true http-brute.hostname: sets the host header in case of virtual...

Nmap NSE net: http-methods

Finds out what options are supported by an HTTP server by sending an OPTIONS request. Lists potentially risky methods. Optionally tests each method individually to see if they are subject to e.g. IP address restrictions. In this script, 'potentially risky' methods are anything except GET, HEAD,...

Nmap NSE net: http-passwd

Checks if a web server is vulnerable to directory traversal by attempting to retrieve '/etc/passwd' or '\boot.ini'. The script uses several technique: Generic directory traversal by requesting paths like '../../../../etc/passwd'. Known specific traversals of several web servers. Query string...

Nmap NSE net: http-vmware-path-vuln

Checks for a path-traversal vulnerability in VMWare ESX, ESXi, and Server CVE-2009-3733. The vulnerability was originally released by Justin Morehouse and Tony Flick, who presented at Shmoocon 2010 http://fyrmassociates.com/tools.html. SYNTAX: http.pipeline: If set, it represents the number of HT...

Nmap NSE net: hostmap

Tries to find hostnames that resolve to the target's IP address by querying the online database at http://www.bfk.de/bfkdnslogger.html. The script is in the 'external' category because it sends target IPs to a third party in order to query their database. SYNTAX: hostmap.prefix: If set, saves the...

Nmap NSE net: http-vhosts

Searches for web virtual hostnames by making a large number of HEAD requests against http servers using common hostnames. Each HEAD request provides a different 'Host' header. The hostnames come from a built-in default list. Shows the names that return a document. Also shows the location of...