Cross-Site Scripting (XSS) in Ad-minister Wordpress plugin

High-Tech Bridge Security Research Lab discovered vulnerability in Ad-minister Wordpress plugin, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Cross-Site Scripting XSS in Ad-minister Wordpress plugin: CVE-2013-6993 The vulnerability exists due to insufficient sanitisation ...

Dokeos 2.2 RC2 SQL Injection Vulnerability

Dokeos version 2.2 RC2 suffers from a remote SQL injection vulnerability. Vendor: Dokeos Vulnerable Versions: 2.2 RC2 and probably prior Tested Version: 2.2 RC2 Advisory Publication: October 30, 2013 without technical details Vendor Notification: October 30, 2013 Public Disclosure: November 27,...

GestioIP <= 3.0 Command Injection Vulnerability - Active Check

GestioIP is prone to a remote command injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ONO Hitron CDE-30364 Router - Denial of Service

ONO Hitron CDE-30364 Router - Denial of Service !/usr/bin/python ----------------------------------------------------------------------------------------- Description: ----------------------------------------------------------------------------------------- Hitron Technologies CDE-30364 is a famo...

ONO Hitron CDE-30364 Router Denial Of Service

!/usr/bin/python ----------------------------------------------------------------------------------------- Description: ----------------------------------------------------------------------------------------- Hitron Technologies CDE-30364 is a famous ONO Router. The Hitron Technologies CDE-30364...

Cross-Site Scripting (XSS) in GuppY

High-Tech Bridge Security Research Lab discovered two XSS vulnerabilities in GuppY, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. 1 Cross-Site Scripting XSS in GuppY: CVE-2013-5983 1.1 The vulnerability exists due to insufficient...

Cotonti 0.9.13 - SQL Injection

Advisory ID: HTB23164 Product: Cotonti Vendor: Cotonti Team Vulnerable Versions: 0.9.13 and probably prior Tested Version: 0.9.13 Vendor Notification: July 10, 2013 Vendor Patch: July 17, 2013 Public Disclosure: July 31, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2013-4789...

Samsung TV - DoS vulnerability

Author: Malik Mesellem - @MMEIT - http://www.itsecgames.com Type: Denial of Service DoS attack Description: DoS vulnerability on some Samsung TVs The web server DMCRUIS/0.1 on port TCP/5600 is crashing by sending a long HTTP GET request Tested successfully on my Samsung PS50C7700 plasma TV...

Nameko Webmail <= 0.10.146 XSS Vulnerability

Nameko Webmail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Category Grid View Gallery XSS Vulnerability

Category Grid View Gallery plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Vatican Cross Site Scripting

vaticanstate.va XSS Vulnerability webcam page ======================================================== Site: http://www.vaticanstate.va/IT/Monumenti/webcam/index?cam=webcam3 Discovered by: Andrea Menin base64 @: bWVuaW4uYW5kcmVhQGdtYWlsLmNvbQ== Follow me: http://www.linkedin.com/in/andreamenin...

Nameko Webmail Cross Site Scripting

Nameko Webmail XSS Vulnerability on version tag that is possible to break and execute any javascript inside a tag . The URL for match the XSS, should be like url-decoded: ?fontsize=11pt;++alertdocument.cookiebody++font-size:11 XSS URL: -------- https:// victim host...

Updated php-geshi package fix security vulnerabilities

A directory traversal and information disclosure local file inclusion flaws were found in the cssgen contrib module application to generate custom CSS files of GeSHi, a generic syntax highlighter, performed sanitization of 'geshi-path' and 'geshi-lang-path' HTTP GET / POST variables. A remote...

D-Link DSL-320B - Multiple Vulnerabilities

D-Link DSL-320B - Multiple Vulnerabilities Device: DSL-320B Firmware Version: EUDSL-320B v1.23 date: 28.12.2010 Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem ============ Vulnerability Overview: ============ Access to the Config...

D-Link DSL-320B Authentication Bypass / Cross Site Scripting

Device: DSL-320B Firmware Version: EUDSL-320B v1.23 date: 28.12.2010 Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem ============ Vulnerability Overview: ============ Access to the Config file without authentication = full...

D-Link DSL-320B - Multiple Vulnerabilities

Device: DSL-320B Firmware Version: EUDSL-320B v1.23 date: 28.12.2010 Vendor URL: http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem ============ Vulnerability Overview: ============ Access to the Config file without authentication = full...

Netgear WNDAP350 / WN604 Wireless Access Point Multiple Information Disclosure Vulnerabilities - Active Check

Various Netgear wireless access point devices are prone to multiple remote information disclosure issues because they fail to restrict access to sensitive information. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

SQL Injection in b2evolution

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. 1 SQL Injection in b2evolution: CVE-2013-2945 The vulnerability exists due to insufficient validation of HTTP...

Free Hosting Manager <= 2.0.2 Multiple Vulnerabilities - Active Check

Free Hosting Manager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : piwigo -- CSRF/Path Traversal (edd201a5-8fc3-11e2-b131-000c299b62e1)

High-Tech Bridge Security Research Lab reports : The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in '/admin.php' script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote...