FPD и XSS уязвимости в Easy Contact для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Cross-Site Scripting уязвимостях в плагине Easy Contact для WordPress. Full path disclosure WASC-13: http://site/wp-content/plugins/easy-contact/econtact.php http://site/wp-content/plugins/easy-contact/econtact-menu.php XSS...

Cetera eCommerce 15.0 SQL Injection / Disclosure

Hello list! I want to warn you about SQL Injection, Full path disclosure, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in Cetera eCommerce. It's engine for online shops. ------------------------- Affected products: ------------------------- Vulnerable are Cetera eCommer...

Magazeen 1.0 Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in theme Magazeen for WordPress and Dotclear. SecurityVulns ID: 11635. ------------------------- Affected products: ------------------------- Similarly to...

XSS, Redirector и IAA уязвимости в MyBB

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, URL Redirector Abuse и Insufficient Anti-automation уязвимостях в MyBB. Для XSS и URL Redirector Abuse используется рабочий аккаунт на уязвимом сайте. О подобных атаках я писал в статье Атаки на незащищённые логин формы...

XSS, AoF и IAA уязвимости в PHP-Nuke

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Abuse of Functionality и Insufficient Anti-automation уязвимостях в PHP-Nuke. XSS WASC-08: POST запрос на странице http://site/modules.php?name=Downloads " style="-moz-binding:url'http://websecurity.com.ua/webtools/xss.xmlxss...

Mimbo Pro 2.3.1 Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in Mimbo Pro theme for WordPress. It's commercial theme for WP by developer of TimThumb. ------------------------- Affected products:...

TimThumb 1.24 XSS / DoS / Path Disclosure

Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in TimThumb and multiple themes for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are TimThumb and all web...

Уязвимости в теме Mimbo Pro для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Full path disclosure, Abuse of Functionality и Denial of Service уязвимостях в теме Mimbo Pro для WordPress. Это коммерческий шаблон для WP. XSS WASC-08:...

Уязвимости в MyBB

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting и SQL DB Structure Extraction уязвимостях в MyBB. Уязвимости имеют место в скриптах search.php и private.php. XSS WASC-08: http://websecurity.com.ua/uploads/2011/MyBB20XSS.html...

MyBB 1.6.1 Login Enumeration / Cross Site Scripting

Hello list! I want to warn you about Abuse of Functionality, Insufficient Anti-automation, XML Injection and Cross-Site Scripting vulnerabilities in MyBB. ------------------------- Affected products: ------------------------- Vulnerable are MyBB 1.6.1 and previous versions. In versions MyBB 1.6.2...

Cetera eCommerce 14.0 Cross Site Scripting / SQL Injection

Hello list! I want to warn you about Cross-Site Scripting, SQL Injection and SQL DB Structure Extraction vulnerabilities in Cetera eCommerce. It's engine for online shops. ------------------------- Affected products: ------------------------- Vulnerable are Cetera eCommerce 14.0 and previous...

Уязвимости в Artefact St. CMS

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, Brute Force и Full path disclosure уязвимостях в системе Artefact St. CMS. Это украинская коммерческая CMS. XSS WASC-08: http://site/search/?s=3Cscript3Ealertdocument.cookie3C/script3E Brute Force WASC-11: http://site/admin/...

Artefact St. CMS Cross Site Scripting / Path Disclosure

I want to warn you about Cross-Site Scripting, Brute Force and Full path disclosure vulnerabilities in Artefact St. CMS. It's Ukrainian commercial CMS. SecurityVulns ID: 11531. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Artefact St. CMS a...

MC Content Manager 10.1.1 Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions o...

XSS, AoF и IAA уязвимости в MC Content Manager

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в системе MC Content Manager. Это украинская коммерческая CMS. XSS WASC-08: Уязвимости на страницах регистрации и восстановления пароля. http://websecurity.com.ua/uploads/2011/MC20Content20Manager20XSS.html...

W-Agora 4.2.1 Cross Site Scripting / Local File Inclusion

Hello list! I want to warn you about Cross-Site Scripting, Local File Inclusion and Brute Force vulnerabilities in W-Agora. SecurityVulns ID: 11499. ------------------------- Affected products: ------------------------- Vulnerable are W-Agora 4.2.1 and previous versions. ---------- Details:...

sfWpCumulusPlugin For Symphony Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerability in plugin sfWpCumulusPlugin for symfony. ------------------------- Affected products: ------------------------- Vulnerable are all versions of sfWpCumulusPlugin. ---------- Details: ---------- This XSS is similar to XSS...

MC Content Manager Cross Site Scripting

Hello list! I want to warn you about Cross-Site Scripting vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are previous versions of MC Content Manager before version v.10.1.1. ---------- Details...

Многочисленные уязвимости в Firebook

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage, Brute Force и Cross-Site Scripting уязвимостях в Firebook. Information Leakage WASC-13: http://site/cgi-bin/firebook/firebook.cgi На странице есть раздел SystemInfo с Full path disclosure и именами txt-файлов БД веб приложения...

Firebook 3.100328 Cross Site Scripting / Leakage

Hello list! I want to warn you about Information Leakage, Brute Force and Cross-Site Scripting vulnerabilities in Firebook. ------------------------- Affected products: ------------------------- Vulnerable are Firebook 3.100328 and previous versions. ---------- Details: ---------- Information...