Magento Update Addresses XSS, CSRF Vulnerabilities

Magento patched 20 vulnerabilities last week, including a stored cross-site scripting XSS flaw in the e-commerce platform that could have let an attacker take over a site and create new admin accounts. Researchers at Sucuri dug up the XSS vulnerability while combing through research audits last...

Advanced Electron Forum 1.0.9 - Cross-Site Request Forgery

Advanced Electron Forum 1.0.9 - Cross-Site Request Forgery + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-CSRF.txt Vendor: ============================= www.anelectron.com/downloads/ Product: ====================================...

Advanced Electron Forum 1.0.9 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications + Credits: hyp3rlinx Vendor: ============================= www.anelectron.com/downloads/ Product: ==================================== Advanced Electron Forum v1.0.9 AEF Exploit patched current version. Vulnerability Type: ===================...

phpDolphin 2.0.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: phpDolphin http://target.com/index.php?a=search&q=teste&filter=m"XSS CSRF ==== We've found no protection against CSRF Cross-site Request Forgery, which made possible to do any kind of act on a user or admin account. NO FORMS are...

Cross site scripting

Cross-site scripting XSS vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipityentryid parameter in an "edit" admin action to serendipityadmin.php...

Online Airline Booking System - Multiple Vulnerabilities

Online Airline Booking System - Multiple Vulnerabilities Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be ...

Online Airline Booking System - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an...

Easy News Pro 1.5 Bypass / SQL Injection / File Upload

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : http://0day.today 0 1 + Support e-mail :...

Arista EOS Remote Arbitrary Code Execution Vulnerability

EOS is Arista's network operating system, a standalone image that runs on all Arista devices and virtual machines. An elevation of privilege vulnerability exists in Arista EOS. By accessing the admin panel, a remote attacker can execute arbitrary code with root privileges...

Mail.ru: [gitmm.corp.mail.ru] Auth Bypass, Information Disclosure

Закрылись ото всех .htaccess-ом, но как-то неправильно выставили права. Я подозреваю, что на конкретные файлы. Или тут просто нижележащий .htaccess имеет приоритет над вышележащим. Ну тем не менее... Тут админка. https://gitmm.corp.mail.ru/login Тут установщик. https://gitmm.corp.mail.ru/setup...

WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability

Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1614 Release Date: ============= 2015-10-07 Vulnerability Laboratory ID VL-ID: ==================================== 1614...

LinuxOptic CMS 2009 - Auth Bypass Session Vulnerability

Document Title: =============== LinuxOptic CMS 2009 - Auth Bypass Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1585 Release Date: ============= 2015-08-26 Vulnerability Laboratory ID VL-ID: ==================================== 15...

Apache Solr < 5.1 Multiple XSS

Binary data 8975.prm...

Kirby 2.0.4 - Remote File Upload Vulnerability

Exploit for php platform in category web applications Title : Kirby 2.0.4 - Remote File Upload Vulnerability Name CMS : kirby Version : 2.0.4 Author :ZwX Download : Date : 04/12/2014 ------------------------------------- Description ------------------------------------- The vulnerability is in th...

WebComIndia CMS 2015Q4 Authentication Bypass Vulnerability

WebComIndia CMS 2015Q4 suffers from an authentication bypass vulnerability via remote SQL injection. Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability Product & Service Introduction: =============================== Where quality & reliability converge. Web.Com Ind...

Wordpress DukaPress Plugin - Persistent XSS Vulnerability

Exploit for php platform in category web applications Tilte Exploit : Wordpress Plugin DukaPress - Persistent XSS Vulnerability Date : 21/09/2015 Author : ZwX Software Vendor : http://dukapress.org/ Software Link: https://wordpress.org/plugins/dukapress/ Version: 2.5.9 Levels Risk : Low Tested on...

WebComIndia CMS 2015Q4 Authentication Bypass

Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1614 Release Date: ============= 2015-10-07 Vulnerability Laboratory ID VL-ID: ==================================== 1614...

Shopify: unauthorized access to all collections name

Hi admins can set tax rates in shopify admin panel https://SHOP.myshopify.com/admin/settings/taxes/ or ... they can add "Tax override" for specific collection, but this action didn't check ShopID! so we can add any collection id, and it will be add to our shop this also will works for "Hidden"...

WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability

Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1614 Release Date: ============= 2015-10-07 Vulnerability Laboratory ID VL-ID: ==================================== 1614...

WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability

Document Title: =============== WebComIndia CMS 2015Q4 - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1614 Release Date: ============= 2015-10-07 Vulnerability Laboratory ID VL-ID: ==================================== 1614...