Prototype of an PHP application 0.1 common.inc.php path_inc Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/24266/info 'Prototype of an PHP application' is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application. An attacker may leverage these issues to...

Devana SQL Injection vulnerability

No description provided by source. Exploit Title: Devana SQL Injection vulnerability Date: 28.03.2010 Author: Valentin Category: webapps/0day Version: Tested on: Debian lenny, Apache2, MySQL5 CVE : Code : :: General information :: Devana SQL injection vulnerability detected :: by Valentin Hoebel ...

Fortinet FortiWeb Web Application Firewall Policy Bypass

No description provided by source. BINAR10 Report on Fortinet Fortiweb Findings 02/05/2012 - Fortinet FortiWeb Web Application Firewall Policy Bypass - ============================================================ 1 Affected Product Fabricant: Fortinet Product name: FortiWeb Version: Latest update...

Revize CMS Query_results.JSP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15481/info Revize CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could...

D3Jeeb Pro 3 catogary.php catid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/16853/info D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation...

Urban Dictionary: Open URL Redirection

An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it. Vulnerable Path:...

Secret: Content Sniffing not disabled

URL :- https://www.secret.ly/ Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are...

XOOPS Glossaire Module - '/modules/glossaire/glossaire-aff.php' SQL Injection

source: https://www.securityfocus.com/bid/67460/info Glossaire module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can leverage this issue to compromise the application, access or...

PYSEC-2014-19

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

kkpw 2.2 /ajax_indus.php SQL注入漏洞

No description provided by source...

NetCms website management system upload vulnerability and fix-vulnerability warning-the black bar safety net

NetCms website management system upload vulnerability and fix Vulnerabilities Web application:NetCms website management system Vulnerability in the file the website registration address:/user/login. aspx 1. First of all, we in the Baidu or Google searchkeywords: “NetCms site management system” ! ...

Localize: HTML Form Without CSRF protection

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Vulnerable Form- http://www.localize.io/ Form inputs:...

Code injection

The application link interface in the NTT DOCOMO sp mode mail application 6100 through 6300 for Android 4.0.x and 6130 through 6700 for Android 4.1 through 4.4 writes message content to the SD card during e-mail composition, which allows attackers to obtain sensitive information via a crafted...

CVE-2013-0340

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

CentOS Update for nss CESA-2013:1829 centos6

Check for the Version of nss OpenVAS Vulnerability Test CentOS Update for nss CESA-2013:1829 centos6 Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Microsoft Office Information Disclosure Vulnerability (2909976)

This host is missing an important security update according to Microsoft Bulletin MS13-104. OpenVAS Vulnerability Test $Id: secpodms13-104.nasl 6125 2017-05-15 09:03:42Z teissa $ Microsoft Office Information Disclosure Vulnerability 2909976 Authors: Antu Sanadi Copyright: Copyright C 2013 SecPod,...

Hacker stole $100,000 from Users of California based ISP using SQL Injection

In 2013 we have seen a dramatic increase in the number of hack attacks attempted against banks, credit unions and utility companies using various techniques including DDoS attack, SQL injection, DNS Hijacking and Zero-Day Flaws. SQL Injection is one of the most common security vulnerabilities on...

Hacker stole $100,000 from Users of California based ISP using SQL Injection

In 2013 we have seen a dramatic increase in the number of hack attacks attempted against banks, credit unions and utility companies using various techniques including DDoS attack, SQL injection, DNS Hijacking and Zero-Day Flaws. SQL Injection is one of the most common security vulnerabilities on...

CVE-2013-1343

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k...

[IronWASP v0.9.6.5] Open Source Advanced Web Security Testing Platform

IronWASP Iron Web application Advanced Security testing Platform is an open source system for web application vulnerability testing. It is designed to be customizable to the extent where users can create their own custom security scanners using it. Though an advanced user with Python/Ruby scripti...