CVE-2015-2976

Multiple cross-site scripting XSS vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted HTML document or 2 a crafted URL that is mishandled during access-log analysis...

CVE-2015-2976

CVE-2015-2976 affects Research Artisan Lite prior to 1.18. The provided documents confirm multiple cross-site scripting (XSS) vulnerabilities (CWE-79) that can allow remote attackers to inject arbitrary scripts via either a crafted HTML document or a crafted URL processed during access-log analys...

Malware cleanup to Gravity Forms arbitrary file upload-vulnerability warning-the black bar safety net

Regular malware detection cleanup process, we encountered one case of infection, caused our attention. Our environment does not have any special or fancy stuff, just updated wordpress and 3 expired plug-in; this situation is quite reasonable. The processing process ends, the environment is clean...

EMC Captiva Capture InputAccel Database Information Disclosure Vulnerability

EMC Captiva Capture is a suite of data capture software. The software captures documents and data from files, electronic documents and other sources and transforms them into digital content delivery with content management systems and business processes. A security vulnerability in the InputAccel...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...

PHP-Nuke Module Addressbook 1.2 - Local File Inclusion Exploit

No description provided by source. !Perl PHP-Nuke Module Addressbook 1.2 Local File Inclusion Exploit Vendor: http://www.sb-websoft.com/index.php?name=CmodsDownload&file=index&req=getit&lid=14 Vulnerable Code: requireoncemodules/$modulename/include/func.inc.php; Coded by bd0rk || SOH-Crew Greetz:...

Webfroot Shoutbox 2.32 Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7746/info Shoutbox is prone to an issue that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient sanitization of the 'conf' URI parameter. An attacker can exploit this...

Greenwood Content Manager 0.3.2 - Local File Inclusion Exploit

No description provided by source. !usr/bin/python Greenwood Content Manager Remote Code Execution AUTHOR : Sina Yazdanmehr R3d.W0rm Discovered by : Sina Yazdanmehr R3d.W0rm Our Site : http://ircrash.com My Official WebSite : http://r3dw0rm.ir IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm...

Webfroot Shoutbox < 2.32 (Apache) Remote Exploit

No description provided by source. !/usr/bin/perl Webfroot Shoutbox 2.32 on apache exploit use IO::Socket; my $host = 127.0.0.1; my $port = 80; my $shoutbox = shoutbox.php?conf=; my $shoutboxpath = /shoutbox; my $cmd = ls -l; my $conn; my $type; my @logs = /etc/httpd/logs/acceslog,...

Maian Gallery 2 - Local File Download Vulnerability

No description provided by source. !/usr/bin/python This vulnerability uses filegetcontents so we have some limitations, we cant execute PHP and we cant read files that the web server will interpret such as PHP, conf etc tested on: Ubuntu Linux 2.6.32 with php v5.3.2 registerglobals = Off PRIVATE...

Symantec Web Gateway 5.0.2.8 Command Execution Vulnerability

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

phpMyAgenda <= 3.1 (templates/header.php3) Local File Include Exploit

No description provided by source. !/usr/bin/perl use IO::Socket; use LWP::Simple; print \n; print \n; print \n; print phpMyAgenda 3.1 Multiple Remote Vulnerabilities Exploit \n; print Bug found By : Ashiyane Corporation \n; print Email: Nima Salehi nimaatashiyane.ir \n; print Web Site :...

DEBIAN-CVE-2013-0337

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...

CVE-2013-0337

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...

UBUNTU-CVE-2013-0337

The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...

SynConnect Pms - index.php?loginid SQL Injection

SynConnect Pms - index.php?loginid SQL Injection Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ======...

CVE-2013-0708

Cross-site scripting XSS vulnerability in dopvCOMET 0009b allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log...

CVE-2013-0709

Cross-site scripting XSS vulnerability in dopvSTAR 0091 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log...

Cross site scripting

Cross-site scripting XSS vulnerability in dopvSTAR 0091 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log...

CVE-2013-0709

CVE-2013-0709 concerns a cross-site scripting (XSS) vulnerability in the dopvSTAR* 0091 product. The issue arises from how the HTTP Referer header is handled during display of the access log, allowing remote attackers to inject arbitrary web script or HTML. The connected JVN entries confirm the a...