Baran CMS 1.0 Arbitrary ASP File Upload/DB/SQL/XSS/CM Vulns

Exploit for unknown platform in category web applications =========================================================== Baran CMS 1.0 Arbitrary ASP File Upload/DB/SQL/XSS/CM Vulns =========================================================== 0x01 Informations : Name : Baran Cms Version : 1.0 Personal...

Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation

Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation 0x01 Informations : Name : Baran Cms Version : 1.0 Personal site : http://www.baran-cms.ir $$ : 50$ Vul : Arbitrary ASP File Upload/DB/SQL/XSS/CM Credit : Aria-Security Team Website :...

CVE-2008-5853

Chilek Content Management System aka ChiCoMaS 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 obtain database credentials via a direct request for config.inc or 2 read database backups via a request for a backu...

Improper access control

Chilek Content Management System aka ChiCoMaS 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 obtain database credentials via a direct request for config.inc or 2 read database backups via a request for a backu...

CVE-2008-5853

Chilek Content Management System aka ChiCoMaS 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to 1 obtain database credentials via a direct request for config.inc or 2 read database backups via a request for a backu...

chicomas <= 2.0.4 (DB Backup/DD/XSS) Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: chicomas =2.0.4 Multiple Vulnerabilities Vendor: http://www.chicomas.com/ Demo: http://demo.opensourcecms.com/chicomas Bug: Database Information Disclosure, Authorization Weakness, XSS Vulnerable Version:...

DEBIAN-CVE-2008-5687

MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/...

vivvocms-destroy.txt

!/usr/bin/perl Vivvo CMS Destroyer [email protected] By Xianur0 -------------CREDITS------------- http://milw0rm.com/exploits/4192 http://milw0rm.com/exploits/3326 http://milw0rm.com/exploits/2339 http://milw0rm.com/exploits/2337 -------------/CREDITS------------- print "\n Vivvo CMS Destroyer B...

Vivvo CMS 3.4 - Multiple Vulnerabilities

Vivvo CMS 3.4 - Multiple Vulnerabilities !/usr/bin/perl Vivvo CMS Destroyer [email protected] By Xianur0 -------------CREDITS------------- http://milw0rm.com/exploits/4192 http://milw0rm.com/exploits/3326 http://milw0rm.com/exploits/2339 http://milw0rm.com/exploits/2337...

Vivvo CMS 3.4 - Multiple Vulnerabilities

!/usr/bin/perl Vivvo CMS Destroyer [email protected] By Xianur0 -------------CREDITS------------- http://milw0rm.com/exploits/4192 http://milw0rm.com/exploits/3326 http://milw0rm.com/exploits/2339 http://milw0rm.com/exploits/2337 -------------/CREDITS------------- print "\n Vivvo CMS Destroyer B...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

integramod-database.txt

today i found some major security problem. the issue can be found at all integramod 1.4.x versions. explanation of the issue: all integramod versions do have a backup folder where the daily database backups are stored. the coders of integramod forgott to secure this folder. example: just head to...

Integramod 1.4.x - Insecure Directory Download Database

Integramod 1.4.x - Insecure Directory Download Database today i found some major security problem. the issue can be found at all integramod 1.4.x versions. explanation of the issue: all integramod versions do have a backup folder where the daily database backups are stored. the coders of integram...

Integramod 1.4.x - Insecure Directory Download Database

today i found some major security problem. the issue can be found at all integramod 1.4.x versions. explanation of the issue: all integramod versions do have a backup folder where the daily database backups are stored. the coders of integramod forgott to secure this folder. example: just head to...

cPanel 11.x => List Directories and Folders

Hello,, I Discovered a new bug in cPanel to show the directions Folders Only on the server in Disk Usage part for example, I tried to see the folders in /etc and it worked ! that would show you a list of directions of folders and that including programes on the server, this could be dangerous ! t...

CVE-2007-6603

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via ...

Improper access control

Hot or Not Clone has insufficient access control for producing and reading database backups, which allows remote attackers to obtain the administrator username and password via a direct request to control/backup/backup.php, which generates a backup/dump/backup.sql file that can be downloaded via ...

CVE-2007-6603

CVE-2007-6603 affects Hot or Not Clone. The issue is insufficient access control for producing/reading database backups: an attacker can trigger control/backup/backup.php to generate a backup.sql and then download it via control/downloadfile.php, exposing administrator credentials. The NVD entry ...