3112 matches found
nss_ldap: Information disclosure
Background nssldap is a Name Service Switch module which allows 'passwd', 'group' and 'host' database information to be pulled from LDAP. Description Josh Burley reported that nssldap does not properly handle the LDAP connections due to a race condition that can be triggered by multi-threaded...
[ GLSA 200711-17 ] Ruby on Rails: Multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...
CVE-2002-2384
hotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2 registry key, which allows local users to gain access to user accounts and steal phone service...
GLSA-200710-31 : Opera: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200710-31 Opera: Multiple vulnerabilities Michael A. Puls II discovered an unspecified flaw when launching external email or newsgroup clients CVE-2007-5541. David Bloom discovered that when displaying frames from different...
jobsite-sql.txt
JobSite Professional v2.0 Remote SQL Injection Vulnerability AUTHOR : ZynbER HOME : NoWhere Script WebSite: http://www.jobsiteprofessional.com Dork english version : inurl:index.php?page=enjobseekers Dork french version : inurl:index.php?page=frCandidats EXPLOITS : Vulnerability in File.php?id=...
FreeBSD : ldapscripts -- Command Line User Credentials Disclosure (3a81017a-8154-11dc-9283-0016179b2dd5)
Ganael Laplanche reports : Up to now, each ldap command was called with the -w parameter, which allows to specify the bind password on the command line. Unfortunately, this could make the password appear to anybody performing a ps during the call. This is now avoided by using the -y parameter and...
Flatnuke 3 - Remote Command Execution Privilege Escalation
Flatnuke 3 - Remote Command Execution Privilege Escalation --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...
BBPortalS 2.0 - Blind SQL Injection
BBPortalS BBsProcesS Remote Blind SQL Injection Exploit Bug Found And Write By Max007 Exploit Tested On V.1.5.10 And V.1.6.2 And 1.5.11 info:For The Version BBPortalS 2.0 name of field is user and password but you have to find name of table !/usr/bin/perl use LWP::UserAgent; $err=1; $www = new...
ldapscripts -- Command Line User Credentials Disclosure
Ganael Laplanche reports: Up to now, each ldap command was called with the -w parameter, which allows to specify the bind password on the command line. Unfortunately, this could make the password appear to anybody performing a ps during the call. This is now avoided by using the -y parameter and ...
jspwiki-xss.txt
Application: JSPWiki Multiple Vulnerabilities Version: 2.4.103 and 2.5.139 Credit: Jason Kratzer Date: 9/24/2007 Background ------------------------------------------------------------ JSPWiki is wiki software built around the standard J2EE components of Java, servlets and JSP. It was written by...
PHP Webquest <= 2.5 (id_actividad) Remote SQL Injection Exploit
Exploit for unknown platform in category web applications =============================================================== PHP Webquest = 2.5 idactividad Remote SQL Injection Exploit =============================================================== / script name : phpwebquest script version : 2.5...
wordpress -- remote sql injection vulnerability
Alexander Concha reports: While testing WordPress, it has been discovered a SQL Injection vulnerability that allows an attacker to retrieve remotely any user credentials from a vulnerable site, this bug is caused because of early database escaping and the lack of validation in query string like...
joomla15-sql.txt
!/usr/bin/php -q -d shortopentag=on getPageParameters; switch $params-get'filtertype', 'title' case 'title' : $where .= ' AND LOWER a.title LIKE '%'.$filter.'%''; break; case 'author' : $where .= ' AND LOWER u.name LIKE '%'.$filter.'%' OR LOWER a.createdbyalias LIKE '%'.$filter.'%' '; break;...
pabugs-sql.txt
!/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; if@ARGV get$sql or err; $res - content = /0-9,a-f32/ or err; print "\n + Admin Passwordmd5=$usid is: $1 \n\n"; sub usage print "---------------------------------------------------------\n"; print "| Bug Found by: umpi |\n"; print...
PHP123 Top Sites - category.php?cat SQL Injection
PHP123 Top Sites - category.php?cat SQL Injection --==+================================================================================+==-- --==+ PHP123 Top Sites SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR:...
AV Arcade 2.1b (view_page.php) Remote SQL Injection
AV Arcade 2.1b viewpage.php Remote SQL Injection Web: AV Arcade 2.1b Site : www.avscripts.net Dork : "Powered By AV Arcade" Author: Kw3rLn tehlostbyteatYaHoOd0tCom Romanian Security Team Ethical Hacking - hTTp://RSTZONE.nET Description: SQL injection in $id of includes/viewpage.php Exploit:...
Buddy Zone 1.5 - Multiple SQL Injections
Buddy Zone 1.5 - Multiple SQL Injections --==+================================================================================+==-- --==+ Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability +==-- --==+================================================================================+==--...
Buddy Zone 1.5 - Multiple SQL Injections
--==+================================================================================+==-- --==+ Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...
Elkagroup Image Gallery 1.0 - SQL Injection
--==+================================================================================+==-- --==+ Image Gallery 1.0 SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SCRIPT DOWNLOAD: N/A SITE:...
GLSA-200706-06 : Mozilla products: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200706-06 Mozilla products: Multiple vulnerabilities Mozilla developers fixed several bugs involving memory corruption through various vectors CVE-2007-2867, CVE-2007-2868. Additionally, several errors leading to crash, memory...