XSS vulnerability in invite-users-panel.vm [$i18n.getText('easyuser.send.invitations.email.placeholder', [$siteTitle]), line 37]

Panopticon http://panopticon.dyn.syd.atlassian.com/ has detected that the following file contains a XSS vulnerability. This vulnerability has been manually confirmed. File: confluence-plugins/confluence-bundled-plugins/confluence-easyuser-admin/src/main/resources/templates/invite-users-panel.vm...

XSS vulnerability in invite-users-panel.vm [$i18n.getText('easyuser.send.invitations.email.placeholder', [$siteTitle]), line 37]

Panopticon http://panopticon.dyn.syd.atlassian.com/ has detected that the following file contains a XSS vulnerability. This vulnerability has been manually confirmed. File: confluence-plugins/confluence-bundled-plugins/confluence-easyuser-admin/src/main/resources/templates/invite-users-panel.vm...

Qool CMS v2.0 RC2 XSRF Add Root Exploit

Summary Qool CMS is a content management system that helps web masters be more productive. Qool has been built with both worlds web master, web developer in mind. It is easy to create addons extensions for the system but you can really do without them too. Description Qool CMS allows users to...

Design/Logic Flaw

DISPUTED MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create...

CVE-2012-5613

MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege to create files as...

Safend Data Protector Multiple Vulnerabilities

Safend Data Protector Multiple Vulnerabilities Client software 3.4.5586.9772: Advisory Link: http://www.reactionpenetrationtesting.co.uk/safend-private-key-log-file.html Details CVE number: CVE-2012-4767 The private key data is in the securitylayer.log file in a directory called "logs.9772". This...

WordPress FoxyPress 0.4.2.5 XSS / CSRF / SQL Injection

WordPress FoxyPress plugin version 0.4.2.5 suffers from cross site request forgery, cross site scripting, path disclosure, remote shell upload, open redirect, and remote SQL injection vulnerabilities. Multiple Vulnerabilities in Wordpress FoxyPress Plugin...

USN-1598-1: Linux kernel vulnerability

An error was discovered in the Linux kernel's network TUN/TAP device implementation. A local user with access to the TUN/TAP interface which is not available to unprivileged users until granted by a root user could exploit this flaw to crash the system or potential gain administrative privileges...

CVE-2011-4961

CVE-2011-4961 affects SilverStripe 2.3.x (pre-2.3.12) and 2.4.x (pre-2.4.6). A remote, authenticated user with EDIT_PERMISSIONS can elevate to administrator by manipulating a TreeMultiselectField when adding the user to selected groups, enabling privileged access. The root cause is described as t...

Subrion CMS 2.2.1 CSRF Add Admin Exploit

Exploit for php platform in category web applications !-- Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit Vendor: Intelliants LLC Product web page: http://www.subrion.com Affected version: 2.2.1 Summary: Subrion is a free open source content management system. It's written in PHP 5 and utilizes...

Subrion CMS 2.2.1 - Cross-Site Request Forgery (Add Admin)

!-- Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit Vendor: Intelliants LLC Product web page: http://www.subrion.com Affected version: 2.2.1 Summary: Subrion is a free open source content management system. It's written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily integrated in...

Splunk 4.3.3 Arbitrary File Disclosure

================================================================= - Release date: September 3rd, 2012 - Discovered by: Marcio Almeida of CIPHER Intelligence Labs - Severity: Medium - CVSS Base Score: 6.3 AV:N/AC:M/Au:S/C:C/I:N/A:N/E:P/RL:U/RC:C...

Splunk 4.3.3 - Arbitrary File Read

Splunk 4.3.3 - Arbitrary File Read Exploit Title: Splunk = 4.3.3 Reading Arbitrary Files Contents Date: 09/03/2012 Exploit Author: Marcio Almeida [email protected] Vendor Homepage: http://www.splunk.com/ Software Link: http://www.splunk.com/download?r=header Version: 4.3.3 and priors...

CVE-2011-5135

Multiple SQL injection vulnerabilities in the saveconnection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the 1 coursereportuiconfigname or 2...

Code injection

The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administrative privileges via unspecified vectors...

CVE-2011-5097

Removed by vendor...

o0mBBS 0.65B SQL Injection

--------------------------------------- Author : L3b-r1'z Title : o0mBBS Sql Injection Date : 6/12/2012 Email : [email protected] Site : Sec4Ever.com & Exploit4arab.com Google Dork : allintext: "o0mBBS version 0.65B" Version : 0.65 --------------------------------------- 1 Bug 2 PoC...

CVE-2012-1013

The check16dummy function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service NULL pointer dereference and daemon crash via a KRB5KDBDISALLOWALLTIX create request that...

CVE-2012-1250

CVE-2012-1250 affects Logitec LAN-W300N/R routers with firmware older than 2.27. The vulnerability is a login-access control flaw that lets remote attackers obtain administrative privileges and modify settings via PPPoE-related vectors. Public sources indicate updating to the latest firmware (2.2...

MyBB 1.6.6 Cross Site Scripting / SQL Injection

Exploit Title: Multiple vulnerabilities in mybb 1.6.6 Google Dork: intext:"Powered By MyBB" Date: 26th March 2012 Author: Aditya Modha Software Link: http://www.mybb.com/downloads Version: 1.6.6 Tested on: ubuntu CVE : Just applied / Y \ / Y /| Y \ /| \ / Y \ | / | | | | | |/|| / | |\ || | | /...