Ncentral 8.x Insecure Access / Unsalted Passwords / CSRF Vulnerabilities

Ncentral versions 8.0.x through 8.2.0-1152 suffer from insecure SOAP access that leads to an unprivileged SSH session, poor trust based authentication leading to database compromise, plain text password storage, cross site request forgery, and other vulnerabilities. RA001: Multiple vulnerabilitie...

Rogers CA Website - SQL Injection Vulnerability

Document Title: =============== Rogers CA Website - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=725 Release Date: ============= 2012-10-02 Vulnerability Laboratory ID VL-ID: ==================================== 725 Common...

Joomla com_package - SQL Injection Vulnerability

Title: ====== Joomla compackage - SQL Injection Vulnerability Date: ===== 2012-07-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=652 VL-ID: ===== 652 Common Vulnerability Scoring System: ==================================== 8.3 Introduction: ============= Joomla is ...

Joomla FireBoard component(com_fireboard) SQL injection and fix-vulnerability warning-the black bar safety net

Effects version 7. 3 Program description Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and intranets and a model–view–controller MVC Web application framework that can also be used independently. Joomla is written in PHP, uses...

Joomla com_fireboard - SQL Injection Vulnerability

Document Title: =============== Joomla comfireboard - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=655 Release Date: ============= 2012-07-10 Vulnerability Laboratory ID VL-ID: ==================================== 655 Commo...

SQL injection in Bigware shop software

The Bigware shop software prior to version 2.17 contains a SQL injection, resulting in full database compromise. The injection point is the POST parameter 'pollid' in the module mainbigware54.php. Proof of concept is at: http://files.dw-itsecurity.de/54.zip Time line: 01/23/2012: Vendor contacted...

Bigware Shop SQL Injection

The Bigware shop software prior to version 2.17 contains a SQL injection, resulting in full database compromise. The injection point is the POST parameter 'pollid' in the module mainbigware54.php. Proof of concept is at: http://files.dw-itsecurity.de/54.zip Time line: 01/23/2012: Vendor contacted...

Pligg CMS 1.2.1 SQL注入漏洞

Bugtraq ID: 53625 Pligg CMS是一款内容管理系统。 Pligg CMS包含的admin/adminindex.php，admin/adminusers.php，module.php脚本不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得数据库信息或控制应用系统。 0 Pligg CMS 1.2.1 厂商解决方案 Pligg CMS 1.2.2已经修复此漏洞，建议用户下载使用： http://forums.pligg.com/downloads.php?do=file&id=15...

CLscript CMS v3.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Title: ====== CLscript CMS v3.0 - Multiple Web Vulnerabilities Common Vulnerability Scoring System: ==================================== 8.6 Introduction: ============= With the professionally developed Classified-Portal CLscript 3.0 can...

Coupon Script v6.0 - SQL Injection Vulnerability

Document Title: =============== Coupon Script v6.0 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=572 Release Date: ============= 2012-05-15 Vulnerability Laboratory ID VL-ID: ==================================== 572 Common...

GENU CMS 2012.3 - Multiple SQL Injection Vulnerabilities

Document Title: =============== GENU CMS 2012.3 - Multiple SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=538 Release Date: ============= 2012-04-29 Vulnerability Laboratory ID VL-ID: ==================================== 53...

DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities

Title: ====== DHTMLX Suite v.3.0 - Multiple Web Vulnerabilities Date: ===== 2012-04-11 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=507 VL-ID: ===== 507 Introduction: ============= To demonstrate the rich possibilities of DHTMLX controls and to show how they work...

Cyberoam Unified Threat Management: OS Command Execution

Hi, Please find below the details of a vulnerability I discovered in Cyberoam UTM device. The Vendor was notified, however I did not receive any response from Vendor despite repeated email reminders. SECURITY ADVISORY: cyberoam-utm-command-executaion Affected Software: Cyberoam CR50ia 10.01.0 bui...

NASA sub-domain and Australian Police targeted by Hackers

NASA sub-domain and Australian Police targeted by Hackers Hacker with name "Black Jester" hack another subdomain https://airtrafficconflictresolutions.arc.nasa.gov of NASA. Hacker compromise the database of site and leak password hashes of Users and Database Info also. The leaked info posed on...

Lebanese Yellow Pages website database Compromised

Lebanese Yellow Pages database Compromised Lebanese Yellow Pages website https://www.yellowpages.com.lb/ database compromised by Hacking Group known as Mad HackerZ Team. Hackers manage to hack database of site and leaked it on internet. Leaked database include the usernames, Password hashes and...

SQL injection in Bigware shop software

The Bigware shop software prior to version 2.15 contains a SQL injection, resulting in full database compromise. The injection point is the POST parameter 'lastname' in the module mainbigware43.php. A user must be created before exploitation. Proof of concept is at...

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0...

AlstraSoft EPay Enterprise v4.0 Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0...

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection

Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0 Tested on: Apache/1.3.37 An attacker may execute arbitra...

WineHQ database compromise - One More Linux Project Fail

WineHQ database compromise - One More Linux Project Fail Jeremy White, Codeweavers Founder has announced that access to the WineHQ database has been compromised. "On the one hand, we saw no evidence of harm to any database. We saw no evidence of any attempt to change the database and candidly,...