MyBB 1.6.1 Login Enumeration / Cross Site Scripting

Hello list! I want to warn you about Abuse of Functionality, Insufficient Anti-automation, XML Injection and Cross-Site Scripting vulnerabilities in MyBB. ------------------------- Affected products: ------------------------- Vulnerable are MyBB 1.6.1 and previous versions. In versions MyBB 1.6.2...

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting XML Injection

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting XML Injection Family Connections CMS 2.3.2 Stored XSS And XPath Injection function xpathdocument.forms"xml".submit; function xssdocument.forms"xss".submit; a href="javascri...

Family Connections CMS 2.3.2 - Persistent Cross-Site Scripting / XML Injection

Family Connections CMS 2.3.2 Stored XSS And XPath Injection function xpathdocument.forms"xml".submit; function xssdocument.forms"xss".submit; br...

Family Connections CMS 2.3.2 (POST) Stored XSS And XML Injection

Summary Family Connections is an open source content management system. It makes creating a private, family website easy and fun. Description FCMS suffers from a stored XSS vulnerability post-auth in messageboard.php script thru the 'subject' post parameter. XML Inj. lies in the /inc/getChat.php...

SmarterStats 6.0 Multiple Vulnerabilities

Exploit for asp platform in category web applications Vendor: SmarterTools Application: SmarterStats 6.0 Bugs: Directory Traversal, File Upload, OS Execution, XML Injection, SQL Injection, DoS Patch: The Vendor has released SmarterStats Version 6.2 at URI...

SmarterMail 7.3 and 7.4 Multiple Vulnerabilities

Exploit for php platform in category web applications Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP Injection, DoS Patch: The Vendor has released SmarterMail Version 8 at URI...

SmarterStats 6.0 - Multiple Vulnerabilities

Hoyt LLC Research | SmarterStats 6.0, OS Command Execution, Directory Traversal, DoS, Coordinated Disclosure Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Vendor: SmarterTools Application: SmarterStats 6.0 Bugs: Directory Traversal, File Upload, OS Execution, XML Injection, SQL...

SmarterMail 7.x Cross Site Scripting / Shell Upload / Traversal

To: Vuln.Lists Re: Coordinated Disclosure, SmarterMail 7.x Versions Private Note - Rewrite as you wish, vendor has acknowledged these bugs and more and issued a fix. ------------------------------ Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: October 28, 2010 Vendor:...

SmarterMail 7.37.4 - Multiple Vulnerabilities

SmarterMail 7.37.4 - Multiple Vulnerabilities Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: October 28, 2010 Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection,...

SmarterMail 7.3/7.4 - Multiple Vulnerabilities

Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me Identified: October 28, 2010 Vendor: SmarterTools Application: SmarterMail 7.x Bugs: Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP Injection, DoS Patch: The Vendor has...

Adobe XML External Entity Injection

Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and 8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2 This module requires Metasploit:...

C9 static article publishing system vulnerabilities 0day-vulnerability warning-the black bar safety net

See the one called C9 static article publishing system The program is just not carefully watched. Today download back a see under found problems in the vote there is a flash voting system, flash I don't understand, then grabbed a pack to see found is by add. asp submitted to the vote of the xml...

CGI Generic XML Injection

By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a very different response, which suggests that it may have been able to modify the behavior of the application and directly access a SOAP back-end. An attacker may be able to...

Adobe Products XML External Entity And XML Injection

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE: CVE-2009-3960 Adobe PSIRT: APSB10-05 -...

Adobe Products XML External Entity And XML Injection Vulnerabilities

Exploit for unknown platform in category dos / poc ==================================================================== Adobe Products XML External Entity And XML Injection Vulnerabilities ==================================================================== Multiple Adobe Products XML External...

Adobe (Multiple Products) - XML External Entity XML Injection

Adobe Multiple Products - XML External Entity XML Injection , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Multiple Adobe Products XML External Entity And XML Injection Vulnerabilities CVE:...

C9 static article publishing system vulnerabilities-vulnerability warning-the black bar safety net

Author:jshell The recent ongoing in-depth study of the asp to down. chinaz. com to see the source code into the habit Been seeing a guy called C9 static article publishing system The program is just not carefully watched Today download back a see under found problems in the vote there is a flash...

SEC Consult SA-20090305-0 :: NextApp Echo XML Injection Vulnerability

SEC Consult Security Advisory 20090305-0 ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1 homepage: http://echo.nextapp.com/site/echo2 found: Feb. 2008 by: Anonymous / SEC...

NextApp Echo < 2.1.1 XML Injection Vulnerability

No description provided by source. SEC Consult Security Advisory 20090305-0 ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1 homepage: http://echo.nextapp.com/site/echo2...

NextApp Echo < 2.1.1 XML Injection Vulnerability

Exploit for multiple platform in category remote exploits ================================================ NextApp Echo ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1...