Apache Axis 1.5 Session Fixation

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira ' 'Leandro Oliveira ' ======== Table of Contents =========================================== 1. Overview 2. Detailed description 3. Other...

PHPWCMS 1.4.5 r398 Cross Site Request Forgery

PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc var frm = document.getElementById"csrf"; frm.submit; window.onload = myfunc; input type="hidden"...

PHPWCMS Cross-Site Request Forgery Vulnerability

No description provided by source. ?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah...

Apache Axis Session Fixation Vulnerability

===== Tempest Security Intelligence - Advisory 02 / 2010 =========== Vulnerability = 'Apache Axis Session Fixation Vulnerability' Authors = 'Tiago Ferreira tiago SPAM tempest.com.br' 'Leandro Oliveira leandro SPAM tempest.com.br' ======== Table of Contents...

CSRF in PHPWCMS 1.4.5

?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah Talamantes RedTeam Security RedTeam Labs...

PHPWCMS 1.4.5 r389 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications =========================================================== PHPWCMS 1.4.5 r389 Cross Site Request Forgery Vulnerability =========================================================== PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc v...

PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery

PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc var frm = document.getElementById"csrf"; frm.submit; window.onload = myfunc; input type="hidden" name="dirpublic" val...

Cross-site Request Forgery (CSRF) in Kryn.cms

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Kryn.cms which could be exploited to perform cross-site request forgery attacks. 1 Cross-site Request Forgery CSRF in Kryn.cms The vulnerability exists due to insufficient validation of the request origin in...

PHPWCMS 1.4.5 r398 - Cross-Site Request Forgery

PHPWCMS 1.4.5 r389 Cross Site Request Forgery function myfunc var frm = document.getElementById"csrf"; frm.submit; window.onload = myfunc; input type="hidden" name="dirpid" value...

Cross-site Scripting (XSS) Vulnerabilities in Scribe CMS

High-Tech Bridge SA Security Research Lab has discovered three vulnerabilities in Scribe CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Scribe CMS 1.1 The vulnerability exists due to input sanitation error in the “f” parameter in...

Apache Axis2 Default Credentials

The installation of Apache Axis2 hosted on the remote web server uses a default set of credentials to control access to its administrative console. A remote attacker can exploit this to gain administrative control. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Cross-site Scripting (XSS) Vulnerability in log1CMS

High-Tech Bridge SA Security Research Lab has discovered two vulnerabilities in log1CMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in log1CMS The vulnerability exists due to input sanitation error in the HTTP POST parameter "content"...

CVE-2010-1985

Multiple cross-site scripting XSS vulnerabilities in the administrative user interface in Six Apart Movable Type 5.0 and 5.01 allow remote attackers to inject arbitrary web script or HTML via unknown vectors...

Cross-site Scripting Vulnerability in razorCMS

High-Tech Bridge SA Security Research Lab has discovered vulnerability in razorCMS which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in razorCMS: CVE-2010-5051 The vulnerability exists due to input sanitation error in the "content" paramete...

Sql injection

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728

CVE-2009-4728 affects the administrative interface of the application “Questions Answered 1.3.” The vulnerability is a SQL injection via the username parameter that could allow an attacker to execute arbitrary SQL commands on the database. Documents do not specify exact vulnerable versions beyond...

CVE-2009-4728

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-0143: Undefined Security Weakness

Unspecified vulnerability in the administrative interface in the embedded HTTPS server on the Cisco IronPort Encryption Appliance 6.2.x before 6.2.9.1 and 6.5.x before 6.5.2, and the IronPort PostX MAP before 6.2.9.1, allows remote attackers to read arbitrary files via unknown vectors, aka IronPo...