Xplico v0.6.1 - Network Forensic Analysis Tool (NFAT)

"The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email POP, IMAP, and SMTP protocols, all HTTP contents, each VoIP call SIP, FTP, TFTP, and so on. Xplico isn't a network protocol analyzer. Xplico is...

PHP-Nuke 7.08.18.1.35 - Wormable Remote Code Execution

PHP-Nuke 7.08.18.1.35 - Wormable Remote Code Execution !/usr/bin/php ?php / Wormable Remote Code Execution in PHP-Nuke 7.0/8.1/8.1.35newist as of release Vendor's Website:http://phpnuke.org/ Secuirty Researcher: Michael Brooks https://sitewat.ch Original Advisory:...

Scribd.com Cross Site Scripting

SecWorm.net - Advisory http://SecWorm.net/ Steam XSS Vulnerability ---------------------------------------------------------------------------- ------ 1. Advisory Information: ---------------------------------------------------------------------------- ------ Title:- Cross Site Scripting...

Imageshack.us Cross Site Scripting

By SecWorm.net - Cross Site Scripting vulnerability in Imageshack.us SecWorm.net - Advisory http://Secworm.net/ Cross Site Scripting XSS issue in Imageshack.us -------------------------------------------------------------- 1. Advisory Information:...

You! Hostit! Cross Site Scripting

view source print? andresg888 Contact : andresg8884tgmaildotcom Web: : www.ilegalintrusion.net & www.bl4ck-p0rtal.org Dork : No DoRk f0R ScRipT KiDDieS Example:...

SuSE9 Security Update : IBM Java5 JRE and SDK (YOU Patch Number 12336)

This update brings IBM Java 5 to Service Release 9. It fixes the following security problems : - A security vulnerability in the Java Runtime Environment JRE may allow an untrusted applet or application to list the contents of the home directory of the user running the applet or application...

Clip Bucket 1.7.1 - Insecure Cookie Handling

Clip Bucket 1.7.1 - Insecure Cookie Handling || || | || o,7 || . o7 || q||| o\, : / / . /QQQQQQQQQQQQQQQQQQQ\ /QQQ/\QQQ\ /QQQQQ/ \QQQQQQ\ /QQQQ/ QQQQ\ /QQQQ/ \QQQQ\ |QQQQ/ By Qabandi \QQQQ| |QQQQ| |QQQQ| |QQQQ| From Kuwait, PEACE... |QQQQ| |QQQQ| |QQQQ| |QQQQ\ iqaahotmail.fr /QQQQ| \QQQQ\ /QQQQ/...

Adobe bitten by XSS bug it invented

Hundreds of thousand websites host vulnerable Adobe Flash files which can be exploited by malicious people to conduct convincing phishing and XSS attacks. In most cases, cookie hijacking is possible. Unsuspecting users can be redirected from trustworthy SSL and non-SSL sites to malware, adware an...

CVE-2009-1580: Improper Authentication

Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie...

FLDS 1.2a SQL Injection

!/usr/bin/perl -w Free Links Directory Script V1.2a Remote SQL Injection Exploit written by ka0x D.O.M Labs Security Researchers - www.domlabs.org - Vuln code report.php: if$COOKIE'logged'=="" ... // login else $linkida = $GET'linkid'; $linkinfo = mysqlfetcharraymysqlquery"select from links where...

openSUSE 10 Security Update : squirrelmail (squirrelmail-5778)

Squirrelmail was updated to use the secure flag for its cookies. Otherwise it was possible to hijack a SSL-protected session via leaked cookies. CVE-2008-3663 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...

CVE-2008-3170: Undefined Security Weakness

Apple Safari allows web sites to set cookies for country-specific top-level domains, such as co.uk and com.au, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session, aka "Cross-Site Cooking," a related issue to CVE-2004-0746, CVE-2004-0866, and...

[Full-disclosure] H4CREW-000005 EasyNews Pro 4.0 XSS & CSRF

I luv u Ms. Phisher u d4 d1am0nds 1n My Ski h4xorCrew Advirosy 5: Easynews PRO 4.0 XSS and CRSF =================================================== "the game of secuirity is like a sord fight you must think furst b4 you m0ve" H-4 h3r3 2 stay cuz we in da h0uz h4xorcewz n da house and r4w we g0nna...

Unfixed XSS vulnerability at wap.sesamportail.com

Security researcher meloulisi, has submitted on 05/11/2007 a cross-site-scripting XSS vulnerability affecting wap.sesamportail.com, which at the time of submission ranked 4167253 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/11/2007. It is...

e107 website system 0.7.5 - 'admin.php?Query String (PATH_INFO)' Cross-Site Scripting

source: https://www.securityfocus.com/bid/19997/info e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. An attacker may levearge this issue to have arbitrary script code execute in the browser of an unsuspecting user i...

CVE-2006-3665

SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this...

CVE-2006-3665

SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this...

CVE-2006-3665

CVE-2006-3665 affects SquirrelMail 1.4.6 and earlier with register_globals enabled. The vulnerability allows remote attackers to hijack cookies via src/redirect.php, with vectors not clearly disclosed in vendor reports. The description notes that “cookie theft” is often linked to XSS, but the ven...

CVE-2006-3665: Undefined Security Weakness

SquirrelMail 1.4.6 and earlier, with registerglobals enabled, allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while "cookie theft" is frequently associated with XSS, the vendor disclosure is too vague to be certain of this...

Maxwebportal <= 1.36 password.asp Change Password Exploit (3 - perl)

Exploit for unknown platform in category web applications ==================================================================== Maxwebportal Gr33tz To == mhp0rtal , Oilkarchack , Str0ke & AlphaST.Com And Iranian Hacking & Security Teams : IHS , Shabgard , Emperor ,Crouz & Simorgh-ev use IO::Socket...