CVE-2009-4298

The LAMS module mod/lams for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the 1 username, 2 firstname, and 3 lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors...

File Access Vulnerability in Easy File Sharing Web Server

File Access Vulnerability in Easy File Sharing Web Server Discovered by: Timothy "Thor" Mullen Testing by Steve "Raging Haggis" Moffat, Hammer of God, Bermuda Labs Product: Easy File Sharing Web Server, current versions, default installation Vendor: http://www.sharing-file.com/ Vendor Notificatio...

Joomla! Component Quick News - SQL Injection

/ ! Joomla Component Quick News SQL injection vulnerability ! Author : Don Tukulesto [email protected] ! Homepage : http://www.indonesiancoder.com ! Date : November 25, 2009 ! Tune In : http://antisecradio.fm choose your weapon / Software Information + Download :...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077...

CVE-2009-4076

Cross-site request forgery CSRF vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijack the authentication of unspecified users for requests that modify user information via unspecified vectors, a different vulnerability than CVE-2009-4077...

JVN#72974205 Roundcube Webmail vulnerable to cross-site request forgery

Roundcube Webmail is an open source webmail client from the Roundcube Webmail Project. Roundcube Webmail contains a cross-site request forgery vulnerability. This issue is different from JVN33820033 and JVN75694913. Impact An attacker may be able to alter the user information within Roundcube...

Pre-Windows 2000 Compatible Access - Windows

The script checks, if Everyone in the Usergroup Pre-Windows 2000 Compatible Access. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

bluecms 0day-vulnerability warning-the black bar safety net

Author: st0p Reprint please indicate the source: http://www.st0p.org Alas, the group where a friend made a CMS, that user information modification section there may be injected, that together with the analysis, the local after installation found, can not use the magicquotesgpc = off in the case,...

Phishing Tool

Added: 09/23/2009 Background This tool serves an HTML form which collects information from users. It allows you to either replicate a real web page, or specify a custom header graphic, a custom footer graphic, and an introductory text message. For best results, design the HTML form to look like a...

Phishing Tool

Added: 09/23/2009 Background This tool serves an HTML form which collects information from users. It allows you to either replicate a real web page, or specify a custom header graphic, a custom footer graphic, and an introductory text message. For best results, design the HTML form to look like a...

PHP Paid 4 Mail Script - paidbanner.php?ID SQL Injection

PHP Paid 4 Mail Script - paidbanner.php?ID SQL Injection + PHP Paid 4 Mail Script ID SQL Injection Vulnerability + Discovered By ThE g0bL!N + http://www.h4ckf0ru.com & http://sec-art.com/cc/ +Homepage : http://www.shop-020.de + Exploit: /paidbanner.php?ID=-1+union+select+1,2,3,4,5,user,7,8,9,10--...

Virtue Online Test Generator (AB/SQL/XSS) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== Virtue Online Test Generator AB/SQL/XSS Multiple Vulnerabilities ==================================================================...

Gravy Media Photo Host 1.0.8 Local File Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================ Gravy Media Photo Host 1.0.8 Local File Disclosure Vulnerability ================================================================...

SQL INJECTION VULNERABILITY--LightOpen CMS Devel 0.1-->

--------------------------------------------------------- SQL INJECTION VULNERABILITY--LightOpen CMS Devel 0.1-- --------------------------------------------------------- CMS INFORMATION: --WEB: http://sourceforge.net/projects/lightopencms/ --DOWNLOAD: http://sourceforge.net/projects/lightopencms...

Gallarific - user.php Arbirary Change Admin Information

Gallarific - user.php Arbirary Change Admin Information gallarific exploit change password Founder : Email: Script: HOME hhttp://www.gallarific.com/ Note:after change password go to...

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

saveFeed $rssversionname, $cacheFile ; ... it calls saveFeed function in an insecure way, arguments are built on $REQUESTversion var and may contain directory traversal sequences... now look at saveFeed function in /rss/feedcreator.class.php ... function saveFeed$filename="", $displayContents=tru...

ST-Gallery 0.1a - Multiple SQL Injections

ST-Gallery 0.1a - Multiple SQL Injections || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...

Absolute Form Processor XE-V 1.5 - Remote Change Password

Absolute Form Processor XE-V 1.5 - Remote Change Password Absolute Form Processor XE-V 1.5 Remote Change Pasword Home:http://www.xigla.com E-mail : Username : Password :/b...

form2list - 'page.php?id' SQL Injection

! ! ! OOOO O OOOOOOOOO ! !O O O O O ! !O O O ! !O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! !O OOO OOO O O O O OO O O O O OO O O O ! !O OO OO O O OOOOOO O O O O O O OOOOOO ! !O O OOOO O O O O O O O O O O O ! ! OOOO OO OOOOOO OOOO OOOOOO OOOOOOOOO OOOO OOO OOO OOOO ! ! OO ! ! OO ! ! OO Prou...

Max.Blog 1.0.6 - show_post.php SQL Injection

Max.Blog 1.0.6 - showpost.php SQL Injection Salvatore "drosophila" Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:"Powered by Max.Blog" Date: 20 Jan 2009 Discovered by: Salvatore "drosophila" Fresta Author:...