CVE-2010-5284

Multiple cross-site scripting XSS vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the 1 User parameter in the edit user profile feature to manageuser.php, 2 y parameter in a newcal action to manageajax.php, and the 3 pic parameter to thumb.php...

XSS vulnerability in atlassian-bonfire-plugin pagination

There is an XSS vulnerability present in the pagination of Bonfire sessions. Steps to reproduce: 1. Create a user with username '" onmouseover="alert4321" blah="' without the single quotes 2. Create at least 21 test sessions owned by this user 3. Visit the user's profile page and click on the tes...

XWiki 4.2-milestone-2 Cross Site Scripting

Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki. Date: 26/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.xwiki.org Software Link: http://enterprise.xwiki.org/xwiki/bin/view/Main/Download Version: 4.2-milestone-2 Gr33Tz: @aviadgolan , @benhayak,...

XWiki 4.2-milestone-2 - Multiple Persistent Cross-Site Scripting Vulnerabilities

XWiki 4.2-milestone-2 - Multiple Persistent Cross-Site Scripting Vulnerabilities Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki. Date: 26/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.xwiki.org Software Link:...

XWiki 4.2-milestone-2 Multiple Stored XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki. Date: 26/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.xwiki.org Software Link: http://enterprise.xwiki.org/xwiki/bin/view/Main/Download Version:...

XWiki 4.2-milestone-2 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki. Date: 26/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.xwiki.org Software Link: http://enterprise.xwiki.org/xwiki/bin/view/Main/Download Version: 4.2-milestone-2 Gr33Tz: @aviadgolan , @benhayak,...

OpenDocMan 1.2.6.1 - Cross-Site Request Forgery (Password Change)

Exploit Title: OpenDocMan Password Change CSRF Date: 22/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.opendocman.com/ Software Link: https://github.com/downloads/opendocman/opendocman/opendocman-1.2.6.1.tar.gz Version: 1.2.6.1 Gr33Tz: @aviadgolan , @benhayak,...

CVE-2012-2296

The Janrain Engage formerly RPX module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability...

Design/Logic Flaw

The Janrain Engage formerly RPX module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability...

CVE-2012-2296

The Janrain Engage formerly RPX module for Drupal 6.x-1.x. 6.x-2.x before 6.x-2.2, and 7.x-2.x before 7.x-2.2 stores user profile data from Engage in session tables, which might allow remote attackers to obtain sensitive information by leveraging a separate vulnerability...

WordPress Cimy User Extra Fields 2.3.7 Shell Upload

Exploit Title: wordpress plugin Cimy User Extra Fields Arbitrary File Upload Vulnerability Google Dork: inurl:"inurl:/wp-content/CimyUserExtraFields" Date: 07/18/2012 Author: Crim3R plugin download Link : http://downloads.wordpress.org/plugin/cimy-user-extra-fields.2.3.7.zip Version: 2.3.7 Tested...

CVE-2012-0793

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors...

Boonex Dolphin v7.0.9 CMS & Mobile App - Multiple Web Vulnerabilities

Title: ====== Boonex Dolphin v7.0.9 CMS - Multiple Web Vulnerabilities Date: ===== 2012-05-18 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=565 http://www.vulnerability-lab.com/getcontent.php?id=566 ID: Changeset 16256 VL-ID: ===== 565 Common Vulnerability Scoring...

qdPM 7 - Arbitrary File upload

Exploit qdPM v.7 Arbitrary File upload Date: June 13th 2012 Author: loneferret Version: 7 Vendor Url: http://qdpm.net/ Tested on: Winddows XP / XAMPP Discovered by: loneferret Software description: Free project management tool for small team qdPM is a free web-based project management tool suitab...

Vanilla FirstLastNames 1.3.2 Cross Site Scripting

Title: Vanilla FirstLastNames 1.3.2 Plugin Persistant XSS Vulnerability Date: 18/5/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 + FirstLastNames 1.3.2 http://vanillaforums.org/addon/firstlastnames-plugin...

Boonex Dolphin v7.0.9 CMS - Multiple Web Vulnerabilities

Document Title: =============== Boonex Dolphin v7.0.9 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=565 Changeset 16256 Release Date: ============= 2012-05-17 Vulnerability Laboratory ID VL-ID:...

Website Toolbox Cross Site Scripting

Exploit Title: Website Toolbox Cross Site Scripting Date: 7.04.2012 Author: Sony Software Link: http://websitetoolbox.com Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC: http://st2tea.blogspot.com/2012/04/website-toolbox-cross-site-scripting.html...

PlumeCMS <= 1.2.4 Multiple Persistent XSS

Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano Binetti...

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities

Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano...

SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability

CVE: CVE-2012-2296 Using Janrain Engage, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user's friends on their social networks. The module permanently retains the...