540 matches found
kq-admin.txt
!/usr/bin/perl use strict; use LWP::UserAgent; print "-+------------------------------------------+-\n"; print "-+- KnowledgeQuest 2.5 Arbitrary Add Admin -+-\n"; print "-+------------------------------------------+-\n"; print "-+- Discovered && Coded By t0pP8uzz -+-\n"; print "-+- This Exploit...
Debian Security Advisory DSA 1477-1 (yarssr)
The remote host is missing an update to yarssr announced via advisory DSA 1477-1. OpenVAS Vulnerability Test $Id: deb14771.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1477-1 yarssr Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
Debian DSA-1477-1 : yarssr - missing input sanitising
Duncan Gilmore discovered that yarssr, an RSS aggregator and reader, performs insufficient input sanitising, which could result in the execution of arbitrary shell commands if a malformed feed is read. Due to a technical limitation of the archive management scripts, the fix for the old stable...
[SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1477-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2008 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1477-1] New yarssr packages fix arbitrary shell command execution
------------------------------------------------------------------------ Debian Security Advisory DSA-1477-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2008 http://www.debian.org/security/faq -...
CVE-2008-0272
Cross-site request forgery CSRF vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users...
CVE-2008-0272
Cross-site request forgery CSRF vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users...
CVE-2008-0272
Cross-site request forgery CSRF vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users...
CVE-2008-0272
CVE-2008-0272 affects the Drupal aggregator module (Drupal 4.7.x before 4.7.11 and 5.x before 5.6). The issue is a cross-site request forgery that lets remote attackers delete items from a feed as privileged users, using a simple GET request. OpenVAS/NVD entries corroborate the CSRF wording and i...
drupal -- cross site request forgery
The Drupal Project reports: The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries...
ZebraFeeds 1.0 - 'zf_path' Remote File Inclusion
To ConTacT mE @ wWw.Asb-May.net/bb ScRiPt:-http://cazalet.org/zebrafeeds/releases/zebrafeeds-current.zip Discovered By:- ThE dE@Th aggregator.php:- requireonce$zfpath . 'includes/feed.php'; requireonce$zfpath . 'includes/view.php'; requireonce$zfpath . 'includes/template.php'; requireonce$zfpath...
[DRUPAL-SA-2006-024] Drupal 4.6.10 / 4.7.4 fixes multiple XSS issues
------------------------------------------------------------------------ ---- Drupal security advisory DRUPAL-SA-2006-024 ------------------------------------------------------------------------ ---- Project: Drupal core Date: 2006-Oct-18 Security risk: Moderately critical Exploitable from: Remot...
FreeBSD : drupal -- multiple XSS vulnerabilities (b2383758-5f15-11db-ae08-0008743bf21a)
The Drupal Team reports : A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...
DRUPAL-SA-2006-024 - Drupal core - Multiple cross site scripting vulnerabilities
Multiple XSS cross site scripting vulnerabilities have been discovered. A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS...
drupal -- multiple XSS vulnerabilities
The Drupal Team reports: A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...
gregariusXSSSQL.txt
http://gregarius.net/ Gregarius is a web-based RSS/RDF/ATOM feed aggregator, designed to run on your web server, allowing you to access your news sources from wherever you want. XSS in search.php: search.php?rssquery=alert1&rssquerymatch=exact XSS in tags.php: tags.php?tag=alert1 SQL Injection in...
Gregarius 0.5.2 XSS and SQL Injection Vulnerabilities
http://gregarius.net/ Gregarius is a web-based RSS/RDF/ATOM feed aggregator, designed to run on your web server, allowing you to access your news sources from wherever you want. XSS in search.php: search.php?rssquery=scriptalert1/script&rssquerymatch=exact XSS in tags.php:...
CVE-2004-2623
Unknown vulnerability in Rippy the Aggregator before 0.10, when registerglobals is enabled, has unknown attack vectors and impact, possibly related to the "user-controlled filter."...
CVE-2004-2623
Technical details about CVE-2004-2623 are not publicly available in the provided documents. No concrete affected product/version, root cause, or remediation is described. Monitor for updates from official sources.