Multiple vulnerabilities in web@all

Advisory ID: HTB23094 Product: web@all Vendor: webatall.org Vulnerable Versions: 2.0 downloaded before 30th of May 2012; prior versions may also be vulnerable Tested Version: 2.0 downloaded on 25th of May 2012 Vendor Notification: 30 May 2012 Vendor Patch: 30 May 2012 Public Disclosure: 20 June...

Web@All 2.0 Cross Site Request Forgery / Cross Site Scripting

Advisory ID: HTB23094 Product: web@all Vendor: webatall.org Vulnerable Versions: 2.0 downloaded before 30th of May 2012; prior versions may also be vulnerable Tested Version: 2.0 downloaded on 25th of May 2012 Vendor Notification: 30 May 2012 Vendor Patch: 30 May 2012 Public Disclosure: 20 June...

web@all - Cross-Site Scripting

web@all - Cross-Site Scripting source: https://www.securityfocus.com/bid/54109/info web@all is prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an...

Sana Net SQL Injection

Exploit Title : Sana Net SQL Injection Author : Black Hat Group Home : greyh4t.com & black-hg.org Software Link : www.sana-net.ir Security Risk : High Version : All Version Dork : inurl:"viewgal.php?op=" p0c : viewgal.php?op=Sql example : http://hotel-alliance.com/viewgal.php?op=61'...

Ndot Deals Script CSRF Vulnerabilties

Exploit for php platform in category web applications Ndot Deals Script Multiple Vulnerabilties ======================================================================= .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.ndot.in/products/ndotdeals-opensource-groupon-clone .:...

DEBIAN-CVE-2012-1013

The check16dummy function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service NULL pointer dereference and daemon crash via a KRB5KDBDISALLOWALLTIX create request that...

Fedora 17 : moodle-2.2.3-1.fc17 (2012-8284)

CVE-2012-2353 MSA-12-0024: Hidden information access issue CVE-2012-2354 MSA-12-0025: Personal communication access issue CVE-2012-2355 MSA-12-0026: Quiz capability issue CVE-2012-2356 MSA-12-0027: Question bank capability issues CVE-2012-2357 MSA-12-0028: Insecure authentication issue...

Baytech Web Design CMS SQL Injection

Exploit Title : baytech web design Cms Sql Injection Vulnerabilitiy Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.baytechwebdesign.com/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : "Web...

Multiple vulnerabilities in web@all

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in web@all, which can be exploited to perform Сross-Site Request Forgery CSRF and Cross-Site Scripting XSS attacks. 1 Сross-Site Request Forgery CSRF in web@all: CVE-2012-3231 1.1 The application allows authorized...

Attractweb SQL Injection

Exploit Title : attractweb Cms Sql Injection Vulnerabilities Author : IrIsT Security Team - BHG Security Center Discovered By : Am!r Home : http://IrIsT.Ir - http://Black-hg.Org Software Link : http://www.attractweb.com/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu -...

Results Unlimited CMS SQL Injection

Exploit Title : results-unlimited Cms Sql Injection Vulnerabilities Author : IrIsT Security Team - Security7 Security Team Discovered By : Am!r Home : http://IrIsT.Ir - http://Security7.Ir Software Link : http://www.results-unlimited.com/ Security Risk : High Version : All Version Tested on :...

N.E.T E-Commerce Group Cross Site Scripting

Exploit Title : N.E.T. E-Commerce Group Cross Site Scripting Author : BHG Security Center - IrIsT Security Team Discovered By : Am!r Home : http://Black-hg.Org - http://IrIsT.Ir Software Link : iranmarketcenter.org Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows...

HelpDesk (All Version) Multiple XSS Presistent Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Feather CMS SQL Injection

Exploit Title : Feather CMS SQL Injection Vulnerability Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Version : All Version Vendor : www.kpsy.net Contact : [email protected] , [email protected] Security Risk : High DorK : "Powered by: Feather Inc"...

ASP-DEv XM Diary SQL Injection

Exploit Title : ASP-DEv XM Diary SQL Injection Vulnerability Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Version : All Version Software Link : http://www.asp-dev.com/download.asp?did=2 Contact : [email protected] , [email protected] Security Ris...

BBSXP CMS SQL Injection

Exploit Title : BBSXP CMS SQL Injection Vulnerability Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Version : All Version Software Link : http://www.bbsxp.com/download.htm Contact : [email protected] , [email protected] Security Risk : High DorK :...

Axous 1.1.0 SQL Injection

Exploit Title : Axous 1.1.0 SQL Injection Vulnerabilitiy Author : Secure-Land Security Team Discovered By : farbodmahini Home : Secure-Land.net Version : All Version Vendor Link : www.axous.com Contact : [email protected] , [email protected] Security Risk : High DorK : intext:"Powered by...

Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress

Advisory ID: HTB23082 Product: All-in-One Event Calendar Plugin for WordPress Vendor: The Seed Studio Vulnerable Versions: 1.4 and probably prior Tested Version: 1.4 Vendor Notification: 21 March 2012 Public Disclosure: 11 April 2012 Vulnerability Type: Cross-Site Scripting XSS CVE References:...

WordPress All-in-One Event Calendar Plugin Multiple Cross Site Scripting Vulnerabilities

All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

WordPress Plugin All-in-One Event Calendar 1.4 - box_publish_button.php?button_value Cross-Site Scripting

WordPress Plugin All-in-One Event Calendar 1.4 - boxpublishbutton.php?buttonvalue Cross-Site Scripting source: https://www.securityfocus.com/bid/52986/info All-in-One Event Calendar plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitiz...