335 matches found
Cross-site Scripting (XSS)
symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. The attacks are possible because the user-supplied section's name and navigation group input parameters in content/content.blueprintssections.php are not properly sanitized...
Media - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-044
This module provides intuitive ways to manage large libraries of media, insert or display or import various types of media either through fields or a wysiwyg interface. Versions of this module prior to 7.x-2.1 or 7.x-3.0-alpha5 did not sufficiently whitelist input parameters for the media browser...
CVE-2016-8719
An exploitable reflected Cross-Site Scripting vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Specially crafted input, in multiple parameters, can cause a malicious scripts to be executed by a victim...
UBUNTU-CVE-2017-5367
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...
OpenMRS 2.3 (1.11.4) - Multiple Cross-Site Scripting Vulnerabilities
OpenMRS 2.3 1.11.4 Multiple Cross-Site Scripting Vulnerabilities Vendor: OpenMRS Inc. Product web page: http://www.openmrs.org Affected version: OpenMRS 2.3, 2.2, 2.1, 2.0 Platform 1.11.4 Build 6ebcaf, 1.11.2 and 1.10.0 OpenMRS-TB System OpenMRS 1.9.7 Build 60bd9b Summary: OpenMRS is an applicati...
kernel: infiniband: uverbs: unprotected physical memory access
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the uverbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate...
Cart Engine 3.0 - Multiple Vulnerabilities
Cart Engine 3.0 - Multiple Vulnerabilities === Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially...
CVE-2014-4599
Multiple cross-site scripting XSS vulnerabilities in forms/search.php in the WP-Business Directory wp-ttisbdir plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 edit, 2 searchterm, 3 pageid, 4 page, or 5 pagelinks parameter...
chillycms 1.1.3 - Multiple Vulnerabilities
No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: chillyCMS Multiple Vulnerabilities Vendor: http://frozenpepper.de/ Vulnerable Version: 1.1.3 Latest version till now Exploitation: Remote with browser Fix: N/A - Description: chillyCMS is a Content...
No-CMS 0.6.6 Cross Site Scripting
Exploit Title: No-CMS 0.6.6 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://getnocms.com Version : 0.6.6 Tested on: Windows Category: webapps Google Dork: intext:"Powered by No-CMS" + Exploit : http:///No-CMS-master/No-CMS-master/index.php/installer/install URL...
WEBTASK SQL injection and fix-vulnerability warning-the black bar safety net
Author: phiA Test system:: BackTrack 5 Example: http://www.revistapenseleve.com.br/exibe.php?id=1395%27 SQLi http://www.reporterbrasil.com.br/exibe.php?id=22%27 SQLi http://www.penseleve.com.br/exibe.php?id=1575%27 SQLi many more @ google ! Solution: Filter exibe. php id=input parameters...
joomla component The Estate Agent (com_estateagent) SQL injection and fix-vulnerability warning-the black bar safety net
Title: joomla component comestateagent SQL injection Vulnerability Author: xDarkSton3x [email protected] Test system platforms: linux + windows Developer: http://www.eaimproved.eu/index.php Test: http://www.badguest.cn/index.php?option=comestateagent&Itemid=4 7&act=object&task=showEO&id=sqli...
Debian Security Advisory DSA 2414-1 (fex)
The remote host is missing an update to fex announced via advisory DSA 2414-1. OpenVAS Vulnerability Test $Id: deb24141.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2414-1 fex Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...
DSA-2414-1 fex - cross-site scripting
Bulletin has no description...
4PSA CMS SQl injection flaws and fixes-vulnerability warning-the black bar safety net
Title: 4PSA CMS SQL Injection Vulnerabilities Author: BHG Security Center www.2cto.com Nitrojen90 Development program official website: http://www.4psa.com/ Affected version: latest version Risk level: high Testing platform: GNU/Linux - Windows Example: http://www.badguest.cn /print. php? id=SQL...
Mediashaker blind defect and repair-vulnerability warning-the black bar safety net
Title: Mediashaker Blind SQL Injection Vulnerabilitiy Author: H4ckCity Security Team www.badguest.cnWwW.H4ckCity.Org Affect all versions Developer: http://www.mediashaker.com/ Testing platform: GNU/Linux Ubuntu - Windows Server - win7 Sample test http://www.badguest.cn /content. php? id=1 Blind S...
Joomla component(com_dshop) SQL injection flaws and fixes-vulnerability warning-the black bar safety net
Title: Joomla Component comdshop SQL Injection Vulnerability Author: CoBRa21 www.badguest.cn uykucu at windowslive.com Level: high risk SQL defects http://www.badguest.cn /PATH/index. php? option=comdshop&controller=fpage&task=flypage&idofitem=1 2 SQL Test example...
phpBB MyPage plugin sql injection and fix-vulnerability warning-the black bar safety net
==================================================== MyPage plugin phpBB SQL Injection All versions ==================================================== Title: SQL Injection on the plugin, phpBB plugin MyPage Author: CrazyMouse from HackSociety.net version: 0.2.3 currently all versions are affect...
Wordpress plugins skysa-official of XSS flaws and fixes-vulnerability warning-the black bar safety net
Wordpress skysa-official plugin to allow the remote computer toxssinsert Wordpress skysa-official plugin Cross-Site Scripting Vulnerabilities Download address: http://wordpress.org/extend/plugins/skysa-official/ Test example: http://www.badguest.cn /path/wp-content/plugins/skysa-official/skysa...