5372 matches found
TGS CMS 0.x SQL Injection / XSS / Disclosure
| | | / | | / | | | \ / | | | / / | |/ \ / / |/ | |/| | | ' \ / | / / | | alertdocument.cookie The Risk: By exploiting this vulnerability, an attacker can inject malicious code in the script and can stole cookies. Fix the vulnerability: Encode output...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
CVE-2009-2705
CVE-2009-2705 affects CA SiteMinder. The vulnerability allows remote attackers to bypass J2EE application XSS protections by submitting a request that uses non-canonical, overlong Unicode in place of blacklisted characters, enabling cross-site scripting bypasses. Documented impact is limited to b...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
PhotoPost PHP 3.3.1 - cat Cross-Site Scripting SQL Injection
PhotoPost PHP 3.3.1 - cat Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/35996/info PhotoPost PHP is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues...
Perl$hop E-Commerce Input Injection
A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one product. It would seem as if the...
Apache APR和APR-util整数溢出漏洞
Bugraq ID: 35949 CVE ID：CVE-2009-2412 Apache APR-util是一款可移植运行库，全名为Apache Portable Runtime。 Apache APR Apache Portable Runtime和'APR-util'存在整数溢出，远程攻击者可以利用漏洞以利用此库的应用程序安全上下文执行任意代码。 -当对齐重定位内存块时memory/unix/aprpools.c存在整数溢出错误，可导致缓冲区溢出。 -当对齐重定位内存块时misc/aprrmm.c中的"aprrmmmalloc", "aprrmmcalloc",...
CS-Cart 2.0.5 - 'reward_points.post.php' SQL Injection
source: https://www.securityfocus.com/bid/35936/info CS-Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data,...
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a l...
Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection
A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one product. It would seem as if the...
IXXO Cart SQL Injection
Original advisory at: http://www.davidsopas.com/2009/07/25/ixxo-cart-standalone-and-joomla-component-sql-injection/ Ref. DSF-03-2009 IXXO Cart! Standalone and Joomla Component SQL Injection Vendor: IXXO Internet Solutions Status: Patched by vendor IXXO Cart! IXXO Cart is an extremely powerful p...
GLSA-200907-06 : Adobe Reader: User-assisted execution of arbitrary code
The remote host is affected by the vulnerability described in GLSA-200907-06 Adobe Reader: User-assisted execution of arbitrary code Multiple vulnerabilities have been reported in Adobe Reader: Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in the JBIG2 filter CVE-2009-019...
Tausch Ticket Script 3 - vote.php?descr SQL Injection
Tausch Ticket Script 3 - vote.php?descr SQL Injection source: https://www.securityfocus.com/bid/43710/info Tausch Ticket Script is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input. Exploiting these issues could allow an attacker to compromi...
Cpanel (lastvisit.html domain) Arbitrary File Disclosure Vuln (auth)
Exploit for multiple platform in category remote exploits ==================================================================== Cpanel lastvisit.html domain Arbitrary File Disclosure Vuln auth ====================================================================...
Cpanel File Disclosure
+===================================================================================+ ./SEC-R1Z / / / / /\ \ |/ / \ \ / / / / | | / | | / / \ / / / / | || / | | / / \ \ \ \2009 | \ | | / / / \ /\ / ||\ \ ||/ \ R.I.P MichaelJackson !!!!!...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Social networking attacks target enterprise data
By Alex Rothacker, Team SHATTER It seems as though the latest rash of threats and attacks all have a familiar ring to them: they’re all aimed at social networking sites like Twitter and Facebook, which is interesting, because smart attackers will use whatever means possible to get to the stuff th...
Senior PHP application vulnerability auditing techniques-vulnerability warning-the black bar safety net
Source:==Ph4nt0m Security Team== ==Ph4nt0m Security Team== Issue 0x03, Phile 0x06 of 0x07 |=---------------------------------------------------------------------------=| |=---------------------= Senior PHP application vulnerability auditing techniques=---------------------=|...
Virtue Shopping Mall (cid) Remote SQL Injection Vulnerability
No description provided by source. CMS : Virtue Shopping Mall WEB : http://www.virtuenetz.com/mall/ Archivo : products.php Variable Tipo : GET valor : cid Tipo : SQL Injection URL : http://www.site.com/products.php?cid=SQLI Exploit : ? $web = $argv1; $url =...