Sony PC Companion 2.1 (DownloadURLToFile()) Stack-based BOF

The vulnerability is caused due to a boundary error in WebServices.dll when handling the value assigned to the 'bstrFile' item in the DownloadURLToFile function and can be exploited to cause a stack-based buffer overflow via an overly long string which may lead to execution of arbitrary code on t...

Hexamail Server 4.4.5 - Persistent Cross-Site Scripting

Title: Hexamail Server meal.txt XSS pop up alert'Hi, what is this?'; root@bt:/ Send email to the victim: root@bt:/ sendemail -f [email protected] -t [email protected] -xu [email protected] \ -xp bob123 -u "Want some meal..?" -o message-file=meal.txt -s mail.example.com Vendor timeline ===============...

Matthew Tom-Wolverton SQL Injection

========================================================================= Matthew Tom-Wolverton Mtwstudios.com SQL-i Vulnerability ========================================================================== +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=+=+= +=+=+...

Membership Site Script - SQL Injection

:::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = Membership Site Script SQL Injection Vulnerability Author = Valentin Hoebel Contact = [email protected] :::::::::::::::::::::::::::::::::::::: 0x2...

Lyrics Script SQL Injection and XSS Vulnerabilities

Exploit for php platform in category web applications =================================================== Lyrics Script SQL Injection and XSS Vulnerabilities =================================================== :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: Gener...

Joomla! Component QPersonel 1.0.2 - SQL Injection

Joomla! Component QPersonel 1.0.2 - SQL Injection Exploit Title: Joomla Component QPersonel SQL Injection Vulnerability Date: 13.04.2010 Author: Valentin Category: webapps/0day Version: XSS security fix from 31.12.2009, 1.02 and before Tested on: Debian Lenny, MySQL 5 CVE : Code :...

OnePC mySite Management Software SQL Injection

Exploit Title: OnePC mySite Management Software SQL Injection Vulnerability Date: 10.04.2010 Author: Valentin Category: webapps/0day Version: Tested on: CVE : Code : :: General information :: OnePC mySite Management Software SQL Injection Vulnerability :: by Valentin Hoebel :: [email protected]...

OnePC mySite Management Software - SQL Injection

OnePC mySite Management Software - SQL Injection Exploit Title: OnePC mySite Management Software SQL Injection Vulnerability Date: 10.04.2010 Author: Valentin Category: webapps/0day Version: Tested on: CVE : Code : :: General information :: OnePC mySite Management Software SQL Injection...

Cross Site Scripting in Oliver Library Management System

BACKGROUND ========== "Oliver is the web-based Library Management System for Schools. Softlink has built on the understanding of thousands of school clients, over many years, and has designed a new system for school libraries and learning resource centres in the 21st century" -- from...

rt-sa-2005-012.txt

Advisory: Pico Server pServ Local Information Disclosure RedTeam found a local information disclosure vulnerability in Pico Server pServ which results in a local user reading all files on the server with pServ's permissions. Details ======= Product: Pico Server pServ Affected Version: 3.3,...