[SECURITY] [DSA 3346-1] drupal7 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3346-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini August 31, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3346-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3346-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini August 31, 2015 https://www.debian.org/security/faq -...

PHPB2B网站管理系统SQL注入漏洞(无视防注入)

简要描述： RT 详细说明： 注入链接：/virtual-office/job.php 注入参数：job 漏洞代码：（第52行开始） if !empty$POST'job' && $POST'save' $vals = $POST'job'; pbsubmitcheck'job'; // 验证post提交的token,可直接使用get访问job.php后在网页源码中搜索formhash获取 $nowjobamount = $job-findCountnull, "created".$todaystart." AND memberid=".$thememberid; if...

Drupal < 5.1 - (post comments) Remote Command Execution Exploit (2)

No description provided by source. !/usr/bin/perl $Id: milw0rmdrupalv5.pl,v 0.2 2007/02/15 13:40:29 str0ke Exp $ milw0rmdrupalv5.pl - Drupal 5.1 Remote Command Execution Exploit Copyright c 2007 str0ke str0ke!milw0rm.com Description ----------- Previews on comments were not passed through normal...

Captcha Bypass in extension "powermail" (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to Captcha Bypass Release Date: April 10, 2014 Bulletin update: September 18, 2014 added CVE Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions:...

Practico 13.9 XSS / CSRF / SQL Injection

Practico 13.9 Multiple Vulnerabilities Vendor: Practico Product web page: http://www.codigoabierto.org Affected version: 13.9 Summary: Practico is a free CMS software project released under license GNU GPL v2.0 for creating web applications in a completely visual and fast fashion. Without...

Apache Tomcat表单验证功能安全绕过漏洞

CVE ID: CVE-2013-2067 Apache Tomcat是一款开放源码的JSP应用服务器程序 Apache Tomcat表单验证功能中的java/org/apache/catalina/authenticator/FormAuthenticator.java不正确处理验证需求和会话之前的关系，允许远程攻击者ilyong漏洞在完成登录表单过程中对已验证资源发送请求，可把请求注入到会话中，使用目标验证凭据执行该请求。此漏洞是会话固定攻击的一个变种 0 Apache Tomcat 6.0.21 - 6.0.36 Apache Tomcat 7.x 厂商解决方案 Apache...

Jahia 5.x CSRF Exploit

------------------------------------------------------------------ -- Info ------------------------------------------------------ ------------------------------------------------------------------ Jahia 5.x CSRF Exploit Jahia is vulnerable to cross-site request forgery because of not validating...

WordPress Plugin Spider Catalog 1.1 - HTML Code Injection / Cross-Site Scripting

1 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Exploit Title: Wordpress Plugin Catalog HTML Code Injection and Cross-site scripting Dork: N/A Date: 31-10-2012 Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R Version: 1.1...

XSS vulnerability in PluXml

Vulnerability ID: HTB22634 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluxml3.html Product: PluXml Vendor: PluXml Team http://pluxml.org/ Vulnerable Version: 5.0.1 and probably prior versions Vendor Notification: 29 September 2010 Vulnerability Type: Stored XSS Cross Site...

CjwSoft ASPGuest Multiple Vulnerability

Exploit for asp platform in category web applications ======================================= CjwSoft ASPGuest Multiple Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ ...

XSS vulnerability in SyndeoCMS

Vulnerability ID: HTB22493 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsyndeocms2.html Product: SyndeoCMS Vendor: The SyndeoCMS team http://www.syndeocms.org/ Vulnerable Version: 2.9.0 and Probably Prior Versions Vendor Notification: 12 July 2010 Vulnerability Type: XSS Cross Sit...

CVE-2010-1273

CVE-2010-1273 affects Emweb Wt prior to 3.1.1. The root cause is that UTF-8 encoding for (1) form values and (2) JSignal arguments is not validated. The provided sources describe the condition and impact as unspecified, with remote attack vectors implied but not detailed. No remediation or fixed ...

Drupal XSS Password Changer

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Problem Description: There have been quite a few Cross Site Scripting XSS vulnerabilities discovered in Drupal modules recently. Many people scoff at XSS and even argue that it's a low threat vulnerability. In many cases this is certainly true, howeve...

Fedora Update for python-formencode FEDORA-2008-6312

Check for the Version of python-formencode OpenVAS Vulnerability Test Fedora Update for python-formencode FEDORA-2008-6312 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

FreeBSD : codeigniter -- arbitrary script execution in the new Form Validation class (83574d5a-f828-11dd-9fdf-0050568452ac)

znirkel reports : The eval function in resetpostarray crashes when posting certain data. By passing in carefully-crafted input data, the eval function could also execute malicious PHP code. Note that CodeIgniter applications that either do not use the new Form Validation class or use the old...

codeigniter -- arbitrary script execution in the new Form Validation class

znirkel reports: The eval function in resetpostarray crashes when posting certain data. By passing in carefully-crafted input data, the eval function could also execute malicious PHP code. Note that CodeIgniter applications that either do not use the new Form Validation class or use the old...

Form submission doesn't check source

Confluence accepts form submissions from any source. This means if you are logged in to confluence and another site submits data to the confluence instance, then its accepted without question because the user is already logged in - or automatically logged in. We need a way to validate the form...

Drupal < 5.1 (post comments) Remote Command Execution Exploit v2

No description provided by source. !/usr/bin/perl $Id: milw0rmdrupalv5.pl,v 0.2 2007/02/15 13:40:29 str0ke Exp $ drupalv5.pl - Drupal Description ----------- Previews on comments were not passed through normal form validation routines, enabling users with the 'post comments' permission and access...

Drupal < 5.1 (post comments) Remote Command Execution Exploit v2

Exploit for unknown platform in category web applications ================================================================ Drupal new; $conn - proxy"http", "http://".$proxy."/" unless !$proxy; sub usage print "? Drupal \n"; print "? usage: perl $0 host directory proxy\n"...