PT-2012-3126

Name of the Vulnerable Software and Affected Versions Basic Analysis and Security Engine BASE version 1.4.5 Description The issue allows remote attackers to execute arbitrary PHP code via a URL in various parameters, including the BASE path parameter to multiple PHP files, the GLOBALSuser session...

PT-2012-2951

Name of the Vulnerable Software and Affected Versions Hitachi IT Operations Director versions 02-50-01 through 02-50-07 Hitachi IT Operations Director versions 03-00 through 03-00-04 Hitachi IT Operations Director versions prior to 03-00-06 Description A cross-site scripting XSS issue allows remo...

Multiple vulnerabilities in ZENphoto

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in ZENphoto, which can be exploited to perform arbitrary PHP code execution, sql injection and cross site scripting attacks. 1 Arbitrary PHP Code Execution in ZENphoto: CVE-2012-0993 Input passed via...

Design/Logic Flaw

EMC RSA Key Manager RKM Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...

Joomla! 1.7.0 Cross Site Scripting

Joomla! 1.7.0 | Multiple Cross Site Scripting XSS Vulnerabilities 1. OVERVIEW Joomla! 1.7.0 stable version is vulnerable to multiple Cross Site Scripting issues. 2. BACKGROUND Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and intranets...

Simple Machines Forum Session Hijacking Vulnerability

The host is installed with Simple Machines Forum and is prone to session hijacking vulnerability. OpenVAS Vulnerability Test $Id: gbsimplemachinesforumsessionhijackingvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ Simple Machines Forum Session Hijacking Vulnerability Authors: Rachana Shetty...

Digital Scribe 1.5 - register_form()' Multiple POST Cross-Site Scripting Vulnerabilities

25: 26: 27: Title:" SIZE=4 Mr., Mrs., etc 28: 29: Last Name:" 30: Password: 31: 32: Password Again: 33: 34: E-Mail: 35:...

Apache Archiva跨站脚本和HTML注入漏洞

Bugtraq ID: 48011 CVE ID：CVE-2011-1077 Apache Archiva是一款管理一个和多个远程存储的软件。 Apache Archiva存在多个存储型和反射型跨站脚本问题，在请求参数中或发送表单中提交包含恶意代码的JavaScript，诱使用户处理可导致恶意脚本在目标用户浏览器上执行，可获得敏感信息或劫持用户会话 Apache Archiva 1.3.4 Apache Archiva 1.3.3 Apache Archiva 1.3.2 Apache Archiva 1.3.1 Apache Archiva 1.3 Apache Archiva...

Lms Web Ensino - Multiple Input Validation Vulnerabilities

Lms Web Ensino - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/46829/info LMS Web Ensino is prone to the following input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities 2. An SQL-injection vulnerability 3. A cross-site...

Abuse of Functionality уязвимости в Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Abuse of Functionality уязвимостях в Drupal. Abuse of Functionality WASC-42: В системе используется ненадёжный механизм смены пароля. В профиле пользователя http://site/user/1/edit можно сменить пароль без знания текущего пароля. И хотя в форме...

NetLink Shell Upload

====================================== NetLink Remote Arbitrary File Upload Vulnerability Download: http://sourceforge.net/projects/kp-netlink/ by lumut-- Homepage: lumutcherenza.biz ====================================== upload.php "; echo ""; echo "Filename: ".$filename; echo "File Type:...

SAP NetWeaver JavaMailExamples - XSS

Application: SAP NetWeaver Versions Affected: SAP NetWeaver JavaMailExamples Vendor URL: http://www.sap.com Bugs:XSS Exploits: YES Reported: 11.05.2010 Vendor response: 12.05.2010 Date of Public Advisory: 19.08.2011 Author: Dmitriy Evdokimov Description SAP Netweaver JavaMailExamples has linked X...

NetWin Surgemail XSS vulnerability

Application NetWin Surgemail 4.3e Vendor NetWin - http://netwinsite.com Discovered by Kerem Kocaer [email protected] Problem ------- Cross-site scripting XSS vulnerability in the Surgemail webmail login page /surgemail allows remote attackers to inject arbitrary web script or HTML. Input...

phpMyAdmin 3.3.5 / 2.11.10 Cross Site Scripting

============================================================================== phpMyAdmin 3.3.5 / 2.11.10 = Cross Site Scripting XSS Vulnerability ============================================================================== 1. OVERVIEW The phpMyAdmin web application was vulnerable to Cross Site...

[Backports-security-announce] Security Update for drupal6

Luigi Gangitano uploaded new packages for drupal6 which fixed the following security problems: SA-CORE-2010-001 Multiple vulnerabilities and weaknesses were discovered in Drupal. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious us...

Debian DSA-2016-1 : drupal6 - several vulnerabilities

Several vulnerabilities SA-CORE-2010-001 have been discovered in drupal6, a fully-featured content management framework. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attac...

[SECURITY] [DSA 2016-1] New drupal6 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-2016-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano March 13, 2010 http://www.debian.org/security/faq -...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts, which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts , which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts, which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...