Gizmo SSL Certificate Vulnerability

Gizmo SSL Certificate Vulnerability I. The Vulnerability Gizmo does not check SSL certificate before sending user credentials. An attacker is able to obtain username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in Gizmo for Linux...

Joomla! Component com_pinboard - task SQL Injection

Joomla! Component compinboard - task SQL Injection !/usr/bin/perl -w Joomla Component compinboard Remote SQL Injection By : Stack POc http://site/index.php?option=compinboard&Itemid=35&action=showpic&task=-48%20union%20select%201,2,3,4,5,6,username,8,9,10%20from%20josusers--...

Sniggabo CMS - 'article.php?id' SQL Injection

milw0rm.com 2009-06-11...

JVN#63832775: Apache Tomcat information disclosure vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat contains a vulnerability which may allow information disclosure or access to the contents contained in the WEB-INF directory. Impact A remote attacker cou...

Virtue Classifieds SQL Injection

CMS : Virtue Classifieds WEB : http://www.virtuenetz.com/classified/ Archivo : search.php Variable Tipo : GET Valor : category Tipo : SQL Injection Url : http:/www.site.com/search.php?category=SQLI PoC:...

CVE-2009-1469

CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element o...

Improper access control

YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt...

CVE-2008-6770

YourPlace 1.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to a database containing user credentials via a direct request for users.txt...

CVE-2009-1460

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

Default credentials

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

CVE-2009-1460

razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...

CVE-2009-1460

CVE-2009-1460 affects razorCMS before 0.4. The issue is weak file system permissions: admin/core/admin_config.php exposes the administrator password hash and FTP credentials to local users; the root directory, datastore/, and admin/core/ also have insufficient permissions, allowing local users to...

Pligg CMS 9.9.0 - 'editlink.php' Blind SQL Injection

!/usr/bin/perl Pligg v9.9 Blind SQL Injection vuln: editlink.php? SQL Injection: magicquotes off This exploit is possible because the $id variable in checkurl.php is taken from the url and then used in an SQL query without being sanitized. by Rohit Bansal [email protected] www.Schap.Org...

CVE-2009-1322

ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb...

Improper access control

ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb...

CVE-2009-1292

UCM-CQ in IBM Rational ClearCase 7.0.0.x before 7.0.0.5, 7.0.1.x before 7.0.1.4, and 7.1.x before 7.1.0.1 on Linux and AIX places a username and password on the command line, which allows local users to obtain credentials by listing the process...

Joomla! Component com_bookJoomlas 0.1 - SQL Injection

Salvatore "drosophila" Fresta + Application: Joomla Component combookjoomlas + Version: 0.1 + Website: http://www.alikonweb.it + Bugs: A SQL Injection + Exploitation: Remote + Dork: inurl:"index.php?option=combookjoomlas" + Date: 06 Apr 2009 + Discovered by: Salvatore "drosophila" Fresta + Author...

Joomla Book Joomlas 0.1 SQL Injection

Salvatore "drosophila" Fresta + Application: Joomla Component combookjoomlas + Version: 0.1 + Website: http://www.alikonweb.it + Bugs: A SQL Injection + Exploitation: Remote + Dork: inurl:"index.php?option=combookjoomlas" + Date: 06 Apr 2009 + Discovered by: Salvatore "drosophila" Fresta + Author...

Improper access control

aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for calendar/calendar.mdb...

CVE-2009-1223

aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for calendar/calendar.mdb...