Advanced Poll Script SQL Injection / Cross Site Scripting

Exploit Title: XSS and Authentication bypass in Advanced Poll Script Date: 26-apr-2010 Author: Sid3^effects Software Link: N/a CVE : Code : XSS and Authentication bypass in Advanced Poll Script Vendor:http://www.2daybiz.com/ Author:Sid3^effects Description : Advanced Poll is a polling system with...

IDEAL Administration 2010 10.2 Buffer Overflow

!/usr/bin/env python IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit Found By: DrIDE Usage: Migrate - Open Migration Project - Bind Shell Download: www.pointdev.com Tested On: Windows XPSP3 windows/shellbindtcp - 696 bytes Encoder: x86/alphamixed EXITFUNC=seh, LPORT=4444 sc =...

CVE-2009-4828: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in administration/admins.php in Ad Manager Pro aka AdManagerPro 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admincreated action. NOTE: some of these details are...

2daybiz Advanced Poll Script XSS and Authentication Bypass

Exploit for php platform in category web applications ========================================================== 2daybiz Advanced Poll Script XSS and Authentication Bypass ========================================================== Description : Advanced Poll is a polling system with powerful...

IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit

Exploit for windows platform in category local exploits ============================================================= IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit ============================================================= !/usr/bin/env python IDEAL Administration 2010 v10.2...

IDEAL Administration 2010 10.2 - Local Buffer Overflow

!/usr/bin/env python IDEAL Administration 2010 v10.2 Local Buffer Overflow Exploit Found By: DrIDE Usage: Migrate - Open Migration Project - Bind Shell Download: www.pointdev.com Tested On: Windows XPSP3 windows/shellbindtcp - 696 bytes Encoder: x86/alphamixed EXITFUNC=seh, LPORT=4444 sc =...

Sql injection

Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the 1 kat parameter to side.asp, and the 2 brugerid and 3 password fields to the administration login feature...

CVE-2009-4798

Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the 1 kat parameter to side.asp, and the 2 brugerid and 3 password fields to the administration login feature...

JIRA is vulnerable to clickjacking attacks

A clickjacking attack on JIRA would most likely take the form of a third-party site, containing an invisible iframe on top of an unrelated page. The iframe would contain a page in JIRA. The victim would believe he was clicking on the other site but would actually be clicking in JIRA and performin...

CVE-2009-4798: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the 1 kat parameter to side.asp, and the 2 brugerid and 3 password fields to the administration login feature...

FreeBSD : krb5 -- remote denial of service vulnerability (a30573dc-4893-11df-a5f9-001641aeabdf)

An authenticated remote attacker can causing a denial of service by using a newer version of the kadmin protocol than the server supports. The MIT Kerberos team also reports the cause : The Kerberos administration daemon kadmind can crash due to referencing freed memory. %NASLMINLEVEL 70300 C...

DSA-2034-1 phpmyadmin - several vulnerabilities

Bulletin has no description...

CVE-2009-4511

The CVE-2009-4511 issue affects TANDBERG Video Communication Server (VCS). It is a directory traversal flaw in the web management interface (two scripts: helppage.php and user/helppage.php) that an authenticated administrator or lower-privilege user could exploit to read arbitrary files on the ap...

CVE-2009-4511

Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server VCS before X5.1 allow remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to 1 helppage.php or 2 user/helppage.php...

Privilege escalation vulnerability when administrator access is compromised

panel:borderColor=ff0000|borderStyle=solid|bgColor=ffccccNote: This issue is superceded by JRA-21004. Please install the patches on that issue, rather than this one. For more details, see JIRA Security Advisory -...

Blog System <= 1.5 Multiple Vulnerabilities

Exploit for php platform in category web applications =========================================== Blog System | www.DigitalWhisper.co.il Software Link: http://www.netartmedia.net/blogsystem/ | http://www.netartmedia.net/blogsystem/demo.html Version: = 1.5 Tested on: PHP Cross Site Scripting...

New Class of XSS Attacks Emerging

A new type of cross-site scripting XSS attack that exploits commonly used network administration tools could be putting users’ data at risk, a researcher says. Read the full article. Dark Reading...

Prediction League 0.3.8 Cross Site Request Forgery

======================================================================================== | Title : Prediction League 0.3.8 CSRF Create Admin User Exploit | Author : indoushka | Home : www.iqs3cur1ty.com/vb | Tested on: Lunix Français v.9.4 Ubuntu | Bug : CSRF Create Admin User Exploit...

IBM WebSphere Application Server 6.0 < 6.0.2.41 Multiple Vulnerabilities

IBM WebSphere Application Server 6.0 before Fix Pack 41 for 6.0.2 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability in the Administration Console. PK97376 - An error when defining a wsadmi...

IBM WebSphere Application Server 7.0 < Fix Pack 9

IBM WebSphere Application Server 7.0 before Fix Pack 9 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability in the Administration Console. PK97376 - An error when defining a wsadmin scripting...