Increased Exploitation in Web Content Management Systems

US-CERT is aware of recent increases in the exploitation of known vulnerabilities in web content management systems CMSs such as Wordpress and Joomla. Compromised CMS installations can be used to host malicious content. US-CERT recommends that users and administrators ensure that their CMS...

XSS and Blind SQL Injection Vulnerabilities in Banana Dance CMS

Information -------------------- Name : XSS and Blind SQL Injection Vulnerabilities in Banana Dance CMS Software : Banana Dance CMS vB.2.1 Vendor Homepage : http://www.doyoubananadance.com Vulnerability Type : Cross-Site Scripting and SQL Injection Severity : Critical Researcher : Canberk Bolat...

[CVE-2012-3871] Openconstructor CMS 3.12.0 'data/hybrid/i_hybrid.php', 'header' parameter Stored Cross-site Scripting Vulnerability

Title: Openconstructor CMS 3.12.0 'data/hybrid/ihybrid.php', 'header' parameter Stored Cross-site Scripting Vulnerability Affected Software: http://www.openconstructor.org/ http://code.google.com/p/openconstructor/downloads/list...

CVE-2012-3791

Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 itemdelete.php, 2 itemstatus.php, 3 itemdetail.php, 4 itemmodify.php, or 5 itemposition.php in admin/; or 6 status parameter to...

Sql injection

Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 itemdelete.php, 2 itemstatus.php, 3 itemdetail.php, 4 itemmodify.php, or 5 itemposition.php in admin/; or 6 status parameter to...

CVE-2012-3791

Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 itemdelete.php, 2 itemstatus.php, 3 itemdetail.php, 4 itemmodify.php, or 5 itemposition.php in admin/; or 6 status parameter to...

CVE-2012-3791

CVE-2012-3791 affects Simple Web Content Management System 1.1. The vulnerability is a set of SQL injection flaws exploitable via the id parameter to admin/item_delete.php, admin/item_status.php, admin/item_detail.php, admin/item_modify.php, admin/item_position.php, and the status parameter to ad...

Simple Web Content Management System 1.1 Multiple SQL Injection

Exploit for php platform in category web applications Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 Discovered by:...

Simple Web Content Management System 1.1 < 1.3 - Multiple SQL Injections

Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 & 1.3 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23 Discovered by: loneferret Side note: This application is nothing...

Simple Web Content Management System 1.1 1.3 - Multiple SQL Injections

Simple Web Content Management System 1.1 1.3 - Multiple SQL Injections Exploit Title: Simple Web Content Management System SQL Injection Date: May 30th 2012 Author: loneferret Version: 1.1 & 1.3 Application Url: http://www.cms-center.com/ Tested on: Ubuntu Server 8.04 / PHP Version...

Baby Gekko CMS v1.1.5c Multiple Stored XSS Vulnerabilities

Exploit for php platform in category web applications Baby Gekko CMS v1.1.5c Multiple Stored Cross-Site Scripting Vulnerabilities Vendor: Baby Gekko, Inc. Product web page: http://www.babygekko.com Affected version: 1.1.5c Summary: BabyGekko strives to deliver high quality websites and other web...

Debian DSA-2455-1 : typo3-src - missing input sanitization

Helmut Hummel of the TYPO3 security team discovered that TYPO3, a web content management system, is not properly sanitizing output of the exception handler. This allows an attacker to conduct cross-site scripting attacks if either third-party extensions are installed that do not sanitize this...

DSA-2455-1 typo3-src - cross site scripting

Bulletin has no description...

[SECURITY] [DSA 2445-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2445-1 [email protected] http://www.debian.org/security/ Florian Weimer March 31, 2012 http://www.debian.org/security/faq -...

FlexCMS 3.2.1 Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : FlexCMS 3.2.1 Multiple CSRF Date : 16-03-2012 Author : Ivano Binetti...

Ektron CMS400.NET Default Password Scanner

Ektron CMS400.NET is a web content management system based on .NET. This module tests for installations that are utilizing default passwords set by the vendor. Additionally, it has the ability to brute force user accounts. Note that Ektron CMS400.NET, by default, enforces account lockouts for...

Microsoft SharePoint Office Document Load Balancer SOAP Vulnerability

Added: 11/23/2011 CVE: CVE-2010-3964 BID: 45264 OSVDB: 69817 Background Microsoft SharePoint is a web application platform that provides web content management and document management as an aid to collaboration among users. SharePoint's multi-purpose design allows for managing and provisioning of...

[SECURITY] [DSA 2289-1] typo3-src security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2289-1 [email protected] http://www.debian.org/security/ Florian Weimer August 07, 2011 http://www.debian.org/security/faq -...

Debian DSA-2289-1 : typo3-src - several vulnerabilities

Several remote vulnerabilities have been discovered in the TYPO3 web content management framework: cross-site scripting, information disclosure, authentication delay bypass, and arbitrary file deletion. More details can be found in the Typo3 security advisory: TYPO3-CORE-SA-2011-001. %NASLMINLEVE...

IBM WebSphere Portal搜索中心跨站脚本漏洞

IBM WebSphere Portal是一款用于创建门户网站的框架。IBM Workplace Web Content Management是一款帮助用户在Internet和内网上发布公司内容的解决方案。 部分传递给搜索中心的输入在返回给用户之前缺少过滤，攻击者可以利用漏洞进行跨站脚本攻击，可获得敏感信息或劫持用户会话。 IBM Websphere Portal 7.0.0.1 IBM Web Content Management 7.0.0.1 用户可参考如下供应商提供的安全公告获得补丁信息：...