758 matches found
CVE-2012-6633
Cross-site scripting XSS vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field...
[Websecurify] Web Security Testing Runtime
A Complete Suite Of Web Security Tools The Suite provides a complete and functional marketplace of highly integrated web application security tools. You will find that different areas are covered by various domain-specific solutions. The Suite consists of automated scanners, fuzzers, utilities an...
CVE-2013-3836
Unspecified vulnerability in the Oracle Web Cache component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to ESI/Partial Page Caching...
DEBIAN-CVE-2013-4315
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWEDINCLUDEROOTS setting followed by a .. dot dot in a ssi template tag...
PYSEC-2013-20
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWEDINCLUDEROOTS setting followed by a .. dot dot in a ssi template tag...
[IronWASP v0.9.6.5] Open Source Advanced Web Security Testing Platform
IronWASP Iron Web application Advanced Security testing Platform is an open source system for web application vulnerability testing. It is designed to be customizable to the extent where users can create their own custom security scanners using it. Though an advanced user with Python/Ruby scripti...
[SECURITY] Fedora 19 Update: smokegen-4.10.4-1.fc19
This package includes Smoke Generator...
Command injection
cgi-bin/performance/perfchart.cgi in the Performance component in GroundWork Monitor Enterprise 6.7.0 does not properly restrict XML content, which allows remote attackers to execute arbitrary commands by creating a .shtml file and leveraging Server Side Includes SSI functionality...
Traidnt up 2.0 (report.php trtext) Blind SQL Injection Vulnerability
Traidnt up is a php online upload script assignmessage,charset$errors."انتظر سوف يتم تحويلك للملف مرة أخري".""; $traidnt-display"message.tpl"; else $ip = getenv'REMOTEADDR'; $reportquery = $db-query" INSERT INTO report reportkey ,reportwhy ,reportip VALUES '$fileid', '$trtext', '$ip';";...
Vbulletin (blog_plugin_useradmin) v4.1.12 Sql Injection Vulnerability
a bug in Vbulletin blogpluginuseradmin v4.1.12 that allows to us to occur a Sql Injection on a Remote machin. Exploit Title : Vbulletin blogpluginuseradmin v4.1.12 Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link :...
PT-2012-1276 · Html2Ps · Html2Ps
Name of the Vulnerable Software and Affected Versions: html2ps versions prior to 1.0b6 Description: The issue allows remote attackers to read arbitrary files via a .. dot dot in the include file SSI directive. This might be a problem in limited scenarios, such as if html2ps is invoked by a web...
UBUNTU-CVE-2012-2922
The requestpath function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q parameter to index.php, which reveals the installation path in an error message...
CVE-2012-2400
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors...
CVE-2012-2403
WordPress: CVE-2012-2403 affects wp-includes/formatting.php in WordPress prior to 3.3.2, where clickable links inside HTML attributes enable cross-site scripting (XSS) via unspecified vectors. The underlying issue is improper handling of links in attributes, allowing injected scripts to execute i...
ShopNC 1.3 tasteless local includes-vulnerability warning-the black bar safety net
This thing in front there is axss http://www.badguest.cn/Article/201107/98039.html -------------------------------------------------------------------------------- GPC before everything is floating clouds. of. So tasteless. it. ./ control/adv.php class advControl / Display advertising / public...
WORK system 4.0.57 Remote File Includes Vulnerability
Exploit for php platform in category web applications Exploit Title: WORK system 4.0.57 Remote File Includes Vulnerability Google Dork: "Worksystem Version 4.0.57" Date: 22/12/2011 Author: Dr.5RaB Software Link http://sourceforge.net/projects/worksystem/files/latest/download: Version: 4.0.57 Test...
Uiga Personal Portal Cross Site Scripting / Blind SQL Injection
Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command input Vulnerable Page: index.php cart.php...
Information disclosure
WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files...
CVE-2011-3792
Pixelpost 1.7.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/functionsfeeds.php and certain other files...