BSDI BSD/OS 4.0,FreeBSD 3.2,NetBSD 1.4 x86,OpenBSD 2.5 UFS Secure Level 1 Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/510/info In 4.4BSD derivatives there are four secure levels that provide for added filesystem security among other things over and above the regular unix permission systems. Part of the secure levels are the system of fil...

Ability Mail Server 2013 (3.1.1) - Stored XSS (Web UI)

No description provided by source. !/usr/bin/env python ''' Exploit Title: Ability Mail Server 2013 Stored XSS Date: 12/20/2013 Exploit Author: David Um Vendor Homepage: http://www.code-crafters.com/ Software Link: http://download.code-crafters.com/ams.exe Version: 3.1.1 Tested on: Windows Server...

LimeSurvey 2.00+ (build 131107) - Multiple Vulnerabilities

No description provided by source. ? LimeSurvey v2.00+ build 131107 Script Insertion And SQL Injection Vulnerability Vendor: LimeSurvey Project Team Product web page: http://www.limesurvey.org Affected version: 2.00+ build 131009 2.00+ build 131022 2.00+ build 131031 2.00+ build 131107 Summary:...

MTP Guestbook 1.0 - Multiple XSS Vulnerabilities

No description provided by source. ?!-- MTP Guestbook 1.0 Multiple Remote Script Insertion Vulnerabilities Vendor: MTP Scripts Product web page: http://www.morephp.net Affected version: 1.0 Summary: MTP Guestbook allows you to put a guestbook on your website. Your visitors can sign it and leave a...

FangMail储存型XSS

简要描述： http://www.fangmail.net/abous/Successcase.html 近10w客户？ 详细说明： 邮件正文插入 即可触发。 漏洞证明：...

[CVE-2013-6233] Persistent HTML Script Insertion permits offsite-bound forms in SpagoBI v4.0

Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6233...

dede getshell exp + temporary patch-vulnerability warning-the black bar safety net

dede good fire old cassock also to scrape together a lively. In fact getshell many methods do not always tangled how to insert mytag table such as near myad table is a good place to update a word did not say more not much to say directly to the getshell exp. getshell exp To change the password wh...

Savsoft Quiz跨站请求伪造漏洞

Savsoft Quiz是基于PHP的在线测验web应用程序。 应用程序允许用户通过未经验证检查的HTTP请求执行某些操作，攻击者可以利用漏洞在欺骗管理员用户登录特制网页时已管理权限创建用户。 0 Savsoft Quiz 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://savsoftquiz.com/web/ form method="POST" name="form0" action="http://savsoftquiz.com/quizdemo/index.php/userdata/insertuser" input...

Discuz! X3. 1 Background to arbitrary code execution can take shell-vulnerability warning-the black bar safety net

See someone ask Discuz! X3. 1 Background how get shell, download it a look, before someone says HTML generation can take the shell, I yesterday the official website to download the version found, the static file extensions, limiting the htm/html. If the server does not exist parsing vulnerability...

SpagoBI 4.0 - Persistent HTML Script Insertion

Exploit for php platform in category web applications SpagoBI1 is an Open Source Business Intelligence suite, belonging to the free/open source SpagoWorld initiative, founded and supported by Engineering Group2. It offers a large range of analytical functions, a highly functional semantic layer...

Slack: Content Spoofing

Here is an unvalidated insertion of an image, resulting to content spoofing https://awayon.slack.com/account/photo?url=http://www.thenewstribe.com/wp-content/uploads/2014/01/Syrian-Electronic-Army-hacked-CNN.jpg It displays any photo, what the attacker must know is just the "awayon" or the team...

SpagoBI 4.0 - Persistent HTML Script Insertion

Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02. Vulnerability Information CVE reference: CVE-2013-6233...

SpagoBI 4.0 - Persistent HTML Script Insertion

SpagoBI 4.0 - Persistent HTML Script Insertion 01. Advisory Information Title: Persistent HTML Script Insertion permits offsite-bound forms Date published: 2014-03-01 Date of last update: 2014-03-01 Vendors contacted: Engineering Group Discovered by: Christian Catalano Severity: Medium 02...

Egroupware 1.8.005 PHP Object Insertion

Vulnerabilities in EGroupware 1.8.005 Discovered by Pedro Ribeiro [email protected] of Agile Information Security ==================================================================== Vulnerability: PHP object insertion leading to all kinds of badness arbitrary file deletion, possible code executio...

ICEWARP 11.0.0.0 Script Insertion

Disclaimer: This code is for Educational Purposes , I would Not be responsible for any misuse of this code Attack type : Remote Patch Status : Unpatched Exploitation : Author: Usman Saeed Company: Xc0re Security Research Group Website: http://www.xc0re.net Twitter : http://twitter.com/emuess...

Cross-Site Scripting (XSS) in Komento Joomla Extension

Advisory ID: HTB23194 Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor Notification: January 2, 2014 Vendor Patch: January 2, 2014 Public...

Joomla! Component Komento 1.7.2 - Persistent Cross-Site Scripting

Joomla! Component Komento 1.7.2 - Persistent Cross-Site Scripting Advisory ID: HTB23194 Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor...

Joomla Komento 1.7.2 Cross Site Scripting

Advisory ID: HTB23194 Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor Notification: January 2, 2014 Vendor Patch: January 2, 2014 Public...

CVE-2012-6629

Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...