WEBJump! Multiple SQL Injection Vulnerabilities

WEBJump! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Bugs Online 'help.asp' SQL Injection Vulnerability

Bugs Online is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Kim Websites 1.0 - Authentication Bypass

Kim Websites 1.0 SQL Injection Vulnerability Authentication bypass Virangar Security Team www.virangar.net -------- Discoverd By : Virangar Security Teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & Ariasecurity team & all hackerz greetz:to my best frien...

CVE-2009-0860

CVE-2009-0860: XSS in the web UI of NetMRI 3.0.1 and earlier, related to error pages. The vulnerability is in the login application’s web interface, allowing remote script/HTML injection via unspecified vectors. CVSS v2 base score 4.3 (Medium) with network attack vector, require no authentication...

nForum Multiple SQL Injection Vulnerabilities

nForum is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

A recap of the 2nd OWASP conference

The second Open Web Application Security Project OWASP Conference held on the Gold Coast is regarded as the leading Web Application Security conference within the Asia Pacific region attracting both Australian and overseas speakers and attendees. The conference continued its community atmosphere...

RedHat Security Advisory RHSA-2009:0340

The remote host is missing updates announced in advisory RHSA-2009:0340. The libpng packages contain a library of functions for creating and manipulating PNG Portable Network Graphics image format files. A flaw was discovered in libpng that could result in libpng trying to free random memory if...

Zabbix 1.6.2 Frontend - Multiple Vulnerabilities

Zabbix 1.6.2 Frontend Multiple Vulnerabilities Name Multiple Vulnerabilities in Zabbix Frontend Systems Affected Zabbix 1.6.2 and possibly earlier versions Severity High Impact CVSSv2 High 9.7/10, vector: AV:N/AC:L/Au:N/C:P/I:C/A:C Vendor http://www.zabbix.com/ Advisory...

lastRSS autoposting bot MOD 0.1.3 - 'phpbb_root_path' Remote File Inclusion

source: https://www.securityfocus.com/bid/33843/info lastRSS autoposting bot MOD is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files containing malicious PHP co...

Fedora Update for php-Smarty FEDORA-2008-9401

Check for the Version of php-Smarty OpenVAS Vulnerability Test Fedora Update for php-Smarty FEDORA-2008-9401 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for Miro FEDORA-2008-1435

Check for the Version of Miro OpenVAS Vulnerability Test Fedora Update for Miro FEDORA-2008-1435 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Ewebeditor2.8.0最终版删除任意文件漏洞

eWebEditor是基于浏览器的、所见即所得的在线HTML编辑器。她能够在网页上实现许多桌面编辑软件（如：Word）所具有的强大可视编辑功能。WEB开发人员可以用她把传统的多行文本输入框TEXTAREA替换为可视化的富文本输入框，使最终用户可以可视化的发布HTML格式的网页内容。eWebEditor!已基本成为网站内容管理发布的必备工具！ 此漏洞存在于Example\NewsSystem目录下的delete.asp文件中，这是ewebeditor的测试页面，无须登陆可以直接进入，看这些代码： ‘ 把带”|”的字符串转为数组 Dim aSavePathFileName...

Team SHATTER Security Advisory: Oracle Database Buffer Overflow in SYS.OLAPIMPL_T.ODCITABLESTART

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Oracle Database Buffer Overflow in SYS.OLAPIMPLT.ODCITABLESTART January 29, 2009 Risk Level: High Affected versions: Oracle Database Server version 9iR2 Remote exploitable: Yes Authentication to Database Server is needed...

MetaBBS 0.11 - Administration Settings Authentication Bypass

MetaBBS 0.11 - Administration Settings Authentication Bypass source: https://www.securityfocus.com/bid/33626/info MetaBBS is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality. Exploiting this...

Synactic ALL_IN_THE_BOX File Overwrite

DSECRG-09-006 Synactis AllINTHEBOX ActiveX Control - Null byte File Owervrite Synactis AllINTHEBOX ActiveX Control ALLINTHEBOX.OCX can be used to owervrite any any file in target system. Vulnerable method is "SaveDoc" Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL:...

ASP-Dev XM Event Diary Multiple Vulnerabilities

The host is running ASP-Dev XM Events Diary and prone to multiple vulnerabilities. Vulnerabilities Insight: - Input passed to the 'cat' parameter in 'default.asp' and 'diaryviewC.asp' are not properly sanitised before being used in SQL queries. - Insufficient access control to the database file...

Sad Raven Guetbook 1.1 passwd.dat Disclosure

!/usr/bin/python Portal Name: Sad Raven's Guestbook version: 1.1 Google Dork: sad Raven's Guestbook Exploit Coded by: PouyaServer Exploit Discovered by: PouyaServer Contact Me: [email protected] import urllib import sys import parser serv="http://" i=0 for arg in sys.argv: i=i+1 if i!=3: pri...

Joomla com_pcchess (game_id) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== Joomla compcchess gameid Blind SQL Injection Exploit ======================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Power Phlogger: SQL injection, DoS...

Masir Camp 3.0 - 'SearchKeywords' SQL Injection

source: https://www.securityfocus.com/bid/33309/info Masir Camp is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...