TestLink 1.9.14 Multiple XSS Vulnerabilities

Exploit for hardware platform in category web applications Information ================================= Name: CSRF Vulnerability in TestLink 1.9.14 Affected Software: TestLink Affected Versions: 1.9.14 and possibly below Vendor Homepage: http://testlink.org/ Severity: High Status: Fixed...

TestLink Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-7391

Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in TestLink 1.9.13 Affected Software : TestLink Affected Versions: 1.9.1.3 and possibly below Vendor Homepage : http://testlink.org/ Vulnerability Type : Cross-site Scripting Severity : Important Status :...

Apple OS X Apple Event Delivery Vulnerability

Apple OS X is an operating system developed by Apple Inc. Apple OS X Apple Event Filter has a security vulnerability that allows Apple events to be sent to a local user session by a linked user via screen sharing...

PowerPress Podcasting < 6.0.5 - Authenticated Cross-Site Scripting (XSS)

By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user’s session by stealing cookies. This means that the malicious hacker can change the logged in user’s password and invalidate the session of the victim while the hacker maintains access. PoC 1. Logon into an...

MGASA-2015-0355 Updated pure-ftpd packages fix security vulnerability

Updated pure-ftpd packages fix security vulnerability: It was reported that the process handling a user session could be crashed by trying to match a file pattern longer than the maximum length for a path...

up.time 7.5.0 - Cross-Site Scripting / Cross-Site Request Forgery (Add Admin)

up.time 7.5.0 XSS And CSRF Add Admin Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: The application allows users to perform certain actions via HTTP...

Drupal Spider Contacts Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP.Spider Contacts is a contact component. A cross-site request forgery vulnerability exists in the Drupal Spider Contacts module that allows remote attackers to construct malicious URIs, trick users into parsing them, and can...

ESC 8832 Data Controller Session Hijacking

=begin Exploit Title: ESC 8832 Data Controller multiple vulnerabilities Date: 2014-05-29 Platform: SCADA / Web Application Exploit Author: Balazs Makany Vendor Homepage: www.envirosys.com Version: ESC 8832 Data Controller Hardware Tested on: ESC 8832 Data Controller Hardware CVE : N/A Yet POC for...

ProjectSend Cross-Site Request Forgery Vulnerability

ProjectSend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. A cross-site request forgery vulnerability exists in ProjectSend. An attacker can exploit the vulnerability to perform unauthorized actions within the context of a user session...

SearchBlox Cross-Site Request Forgery Vulnerability

SearchBlox is an enterprise search solution , built on Lucene . SearchBlox has a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious operations in the context of the target user...

74CMS 3.5.1 /wap/wap-resume-show.php SQL注入漏洞

/wap/wap-resume-show.phpifintval$SESSION"uid"0 $sql="select from ".table"companydownresume"." where companyuid=$SESSIONuid and resumeid=$GETid "; $downresume=$db-getone$sql; $smarty-assign'downresume',$downresume; $time=time; $jobssql="select from ".table"jobs"." where uid=$SESSIONuid and display...

PHPMyRecipes 1.2.2 - dosearch.php?words_exact SQL Injection

PHPMyRecipes 1.2.2 - dosearch.php?wordsexact SQL Injection !/usr/bin/python import httplib from bs4 import BeautifulSoup import re import os Function that takes an SQL select statement and inject it into the wordsexact variable of dosearch.php Returns BeautifulSoup object def sqliselect: inject =...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.4 Multiple Vulnerabilities

The remote host is running a version 8.1.4.x of IBM Rational License Key Server Administration and Reporting Tool RLKS that is prior to 8.1.4.4. It is, therefore, affected by multiple vulnerabilities : - The secure flag for session cookies is not properly set when in SSL mode. An attacker can...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

phpMyFAQ 2.8.x - Multiple Vulnerabilities Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specif...

phpMyFAQ 2.8.X - Multiple Vulnerabilities

Latest phpMyFAQ software suffers on multiple CSRF and XSS vulnerabilities, uh. Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is...

XRMS - Blind SQL Injection and Command Execution

No description provided by source. XRMS Blind SQLi via $SESSION poisoning, then command exec import urllib import urllib2 import time import sys usercharac =...

OctavoCMS <= 3.1.1 XSS Vulnerability - Active Check

OctavoCMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SkaDate Lite 2.0 CSRF / Cross Site Scripting

SkaDate Lite 2.0 Mu...

Syzygy CMS <= 0.3 (Auth Bypass) SQL Injection Vulnerability

No description provided by source. --+++=========================================================================+++-- --+++====== Syzygy CMS = 0.3 Auth Bypass SQL Injection Vulnerability ======+++-- --+++=========================================================================+++-- + Syzygy CMS ...

Helios Calendar 1.1/1.2 Admin/Index.PHP Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26312/info Helios Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in ...