Joomla! Component com_gallery_wd - SQL Injection

Joomla! Component comgallerywd - SQL Injection Exploit Title: Joomla Gallery WD - SQL Injection Vulnerability Google Dork: inurl:option=comgallerywd Date: 29.03.2015 Exploit Author: CrashBandicot @DosPerl Vendor HomePage: http://web-dorado.com/ Source Component :...

Mandriva Linux Security Advisory : python-django (MDVSA-2015:109)

Updated python-django packages fix security vulnerabilities : Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments CVE-2015-0219. Mikko Ohtamaa discovered that Django...

Microsoft Internet Explorer EUC-JP Character Encoding Cross Site Scripting - Ver2 (CVE-2013-3192)

A universal cross site scripting vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to the way that IE handles EUC-JP character encoding. A remote attacker could exploit this vulnerability by submitting specially crafted HTML code into a target web site that uses EUC-JP...

DEBIAN-CVE-2015-2317

The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting XSS attacks via a control character in a URL, as demonstrated by a...

PYSEC-2015-9

The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting XSS attacks via a control character in a URL, as demonstrated by a...

PYSEC-2015-9

The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting XSS attacks via a control character in a URL, as demonstrated by a...

Log forging vulnerability

It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...

Memory corruption

The mmfslinux kernel module in IBM General Parallel File System GPFS 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service memory corruption via unspecified character-device ioctl calls...

HDWIKI最新版Update注入可修改管理员密码（MYSQL进制技巧）

简要描述： 最新版HDWIKI 5.1 GBK 无视GPC 上首页吧！ 详细说明： 问题出在\hdwiki\control\user.php下 最新版HDWIKI 5.1 GBK版本 HDWIKI全局过滤，但是面对宽字节注入，就容易出问题了 function doeditprofile ifisset$this-post'submit' $gender = intval$this-post'gender'; $birthday = strtotime$this-post'birthday'; $location = $this-post'location'; $signature =...

Reverse Shells With Terminal Support: revsh

revsh is a tool for establishing reverse shells with terminal support, reverse VPNs for advanced pivoting Pivoting , as well as arbitrary data tunneling. A reverse shell is a network connection that grants shell access to a remote host. As opposed to other remote login tools such as telnet and ss...

Updated icu packages fix security vulnerabilities

Updated icu packages fix security vulnerabilities: The Regular Expressions package in International Components for Unicode ICU 52 before SVN revision 292944 allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via vectors related to a...

ICU: uninitialized value use in the collation component

The collator implementation in i18n/ucol.cpp in International Components for Unicode ICU 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have...

Information disclosure

The collator implementation in i18n/ucol.cpp in International Components for Unicode ICU 52 through SVN revision 293126, as used in Google Chrome before 40.0.2214.91, does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have...

CVE-2014-7940

CVE-2014-7940 affects ICU 52 and derived Chrome builds; the collator in i18n/ucol.cpp does not initialize memory for a data structure, enabling denial of service or unspecified impact via crafted input. Public-module details: linked advisories show remediation by upgrading ICU to newer releases (...

CVE-2014-9575

VDG Security SENSE formerly DIVA before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : colon character in the Authorization HTTP header...

CVE-2014-4634

Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character...

Crlf injection

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

miniBB 3.1 Blind SQL Injection

Exploit Title: miniBB 3.1 Blind SQL Injection Date: 23-11-2014 Software Link: http://www.minibb.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ CVE: CVE-2014-9254 Category: webapps 1. Description pregmatch only check if $GET'code'...

CVE-2013-7401

The parserequest function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service crash via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method...

Scarlet Daisy Web CMS Cross Site Scripting

Scarlet Daisy Web CMS / || / / / / /\ /\ \ \ \ | / \ / http://h4x0resec.blogspot.com / \ | \ \ / // / \ / / / / Software info |App. : Scarlet Daisy Web Web Content Management System. |Software: http://www.scarletdaisy.com |Vulnerability Style : Cross Site Scripting |Date : "09.12.2014"...