mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

Mahara Multiple Remote Vulnerabilities

This host is running Mahara and is prone to multiple remote vulnerabilities. OpenVAS Vulnerability Test $Id: gbmaharamultvuln.nasl 7029 2017-08-31 11:51:40Z teissa $ Mahara Multiple Remote Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone Networks GmbH,...

CVE-2011-1690

Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors...

HTB22880: XSS vulnerability in CosmoShop

Vulnerability ID: HTB22880 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityincosmoshop1.html Product: CosmoShop Vendor: Zaunz Publishing GmbH http://www.cosmoshop.de/ Vulnerable Version: ePRO V10.05.00 Vendor Notification: 24 February 2011 Vulnerability Type: Stored XSS Cross Site...

Lms Web Ensino - Multiple Input Validation Vulnerabilities

Lms Web Ensino - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/46829/info LMS Web Ensino is prone to the following input-validation vulnerabilities: 1. Multiple cross-site scripting vulnerabilities 2. An SQL-injection vulnerability 3. A cross-site...

ZenPhoto 1.3 - '/zp-core/full-image.php?a' SQL Injection

source: https://www.securityfocus.com/bid/43021/info Zenphoto is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based...

XSS vulnerability in TCMS

Vulnerability ID: HTB22574 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityintcms.html Product: TCMS Vendor: Target CMS http://targetcms.com/ Vulnerable Version: 100728 and Probably Prior Versions Vendor Notification: 09 August 2010 Vulnerability Type: XSS Cross Site Scripting Status:...

Preation Eden Platform 27.7.2010 - Multiple HTML Injection Vulnerabilities

Preation Eden Platform 27.7.2010 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/42321/info Preation Eden Platform is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in...

XSS vulnerability in WebPress

Vulnerability ID: HTB22480 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinwebpress2.html Product: WebPress Vendor: YWP http://www.goywp.com/ Vulnerable Version: Current at 01.07.2010 and Probably Prior Versions Vendor Notification: 01 July 2010 Vulnerability Type: XSS Cross Site...

XSS vulnerability in WebPress

Vulnerability ID: HTB22478 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinwebpress.html Product: WebPress Vendor: YWP http://www.goywp.com/ Vulnerable Version: Current at 01.07.2010 and Probably Prior Versions Vendor Notification: 01 July 2010 Vulnerability Type: XSS Cross Site...

SoftComplex PHP Event Calendar 1.5 - Multiple Remote Vulnerabilities

source: https://www.securityfocus.com/bid/41043/info SoftComplex PHP Event Calendar is prone to multiple remote security vulnerabilities including cross-site scripting, HTML-injection, directory-traversal, and cross-site request-forgery issues. Attackers can exploit these issues to obtain sensiti...

CMS Made Simple 1.x - Cross-Site Scripting Cross-Site Request Forgery

CMS Made Simple 1.x - Cross-Site Scripting Cross-Site Request Forgery source: https://www.securityfocus.com/bid/40483/info CMS Made Simple is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied inputs. The application is also...

New MySpace Attack Launches Zeus Spyware

The latest MySpace attack tries to lure recipients into giving up their MySpace credentials, and then attempts to trick victims into installing password-stealing malicious software. Attackers began blasting out the junk e-mails early Monday, according to researchers at the University of Alabama,...

Improper access control

Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for admin/backup/datadump.sql...

Apple iTunes Multiple Vulnerabilities

Apple iTunes is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes"; ifdescription...

pPIM Multiple Remote Vulnerabilities

pPIM is prone to multiple vulnerabilities, including two security-bypass issues, a cross-site scripting issue, and a file-upload issue. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holder...

CVE-1999-1593

Windows Internet Naming Service WINS allows remote attackers to cause a denial of service connectivity loss or steal credentials via a 1Ch registration that causes WINS to change the domain controller to point to a malicious server. NOTE: this problem may be limited when Windows 95/98 clients are...

wholesale-sql.txt

| | | Wholesale track.php id Remote SQL Injection Vulnerability | | | | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | | email: [email protected] | | | | script : http://www.phpstore.info/productinfo.php?cPath=3653&productsid=162 | | DorK : inurl:"track.php?id=" | Exploit:...

One-News - Multiple Input Validation Vulnerabilities

One-News - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/30804/info One-News is prone to multiple input-validation vulnerabilities, including an SQL-injection issue and multiple HTML-injection issues. The vulnerabilities occur because the application fails to...

miniBB 2.2 - 'bb_admin.php' Cross-Site Scripting Vulnerability

miniBB 2.2 'bbadmin.php' Cross-Site Scripting Vulnerability. Webapps exploit for php platform source: http://www.securityfocus.com/bid/28957/info miniBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue ...