Hewlett-Packard Data Protector Backup Client Service RxNtSetup Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute remote code on vulnerable installations of HP Data Protector. Authentication is not required to exploit this vulnerability. This specific flaw exists in the Backup Client Service OmniInet.exe. The Backup Client Service listens on TCP port 5555...

Cubic CMS多个安全漏洞

Cubic CMS是一款内容管理系统。 由于/login.usuario没有正确过滤传递的'login'和'pass' POST参数的用户输入，允许远程攻击者注入或操纵SQL查询。 0 Cubic CMS 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.cubicfactory.com/ I. BACKGROUND ------------------------- "CUBIC CMS" is a non-free content management system for websites and portals o...

Saurus CMS 4.7.1 Multiple Vulnerabilities

Saurus CMS version 4.7.1 suffers from cross site scripting, remote file inclusion, local file inclusion, information disclosure, remote SQL injection, HTTP response splitting, cross site request forgery, and directory traversal vulnerabilities. Saurus CMS 4.7.1 LFI / RFI / XSS / SQL Injection /...

Saurus CMS 4.7.1 - Multiple Vulnerabilities

Saurus CMS 4.7.1 - Multiple Vulnerabilities waraxe-2013-SA106 - Multiple Vulnerabilities in Saurus CMS 4.7.1 ================================================================================ Author: Janek Vind "waraxe" Date: 14. July 2013 Location: Estonia, Tartu Web:...

[waraxe-2013-SA#098] - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1

waraxe-2013-SA098 - Directory Traversal Vulnerabilities in OpenCart 1.5.5.1 =============================================================================== Author: Janek Vind "waraxe" Date: 19. March 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-98.html Description of vulnerabl...

EMC AlphaStor Device Manager Format String (CVE-2013-0929)

A denial of service or executing arbitrary commands has been reported in EMC AlphaStor Device. The vulnerability is caused by insufficient sanitization when processing certain requests. A remote attacker could trigger this flaw by processing certain requests...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

Cisco Identity Services Engine contains multiple vulnerabilities that could allow an unauthenticated, remote attacker to conduct cross-site request forgery attacks on a targeted system. The vulnerability is due to insufficient sanitization of user-supplied input processed by the ISE Administrator...

Santilga CMS 1.2.6.3 Cross Site Request Forgery / SQL Injection

Exploit for php platform in category web applications ============================= Vulnerable software: Santilga CMS version 1.2.6.3 $ head -n 10 Admin.php|less view-templateName = "admin"; parent::construct; $this-lang = SantilgaLanguage::getInstance-getLanguage; $this-view-lang = $this-lang;...

seditio_PmOS_plugin_XSS_vuln

============================================================================ Vulnerable Software: PmOS - Pm Okuma Sistemi plugin for Seditio CMS. http://seditio-eklenti.com/datas/users/1-pmoku.rar MD5 SUM: 88235c2b4b0613bff87545d2d887f042 1-pmoku.rar...

PmOS - Pm Okuma Sistemi Cross Site Scripting

============================================================================ Vulnerable Software: PmOS - Pm Okuma Sistemi plugin for Seditio CMS. http://seditio-eklenti.com/datas/users/1-pmoku.rar MD5 SUM: 88235c2b4b0613bff87545d2d887f042 1-pmoku.rar...

'research_display.php' SQL Injection Vulnerability

researchdisplay.php is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

Response Splitting Vulnerability in Ruby on Rails

A response splitting flaw can allow a remote attacker to inject arbitrary HTTP headers into a response due to insufficient sanitization of the values provided for response content types...

HP Data Protector Backup Client Service GET_FILE Directory Traversal Vulnerability

This vulnerability allows remote attackers directory traversal on vulnerable installations of HP OpenView Data Protector. Authentication is not required to exploit this vulnerability. This specific flaw exists in the Backup Client Service OmniInet.exe. The Backup Client Service listens on TCP por...

RHEL 6 : dhcp (RHSA-2011:0428)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0428 advisory. The Dynamic Host Configuration Protocol DHCP is a protocol that allows individual devices on an IP network to get their own network configuration...

dhcp security update

12:4.1.1-12.P1.4 - Better fix for CVE-2011-0997: making domain-name check more lenient 690578 12:4.1.1-12.P1.3 - dhclient: insufficient sanitization of certain DHCP response values CVE-2011-0997, 690578...

vBSEO 3.2.23.5.2 - Persistent Cross-Site Scripting via LinkBacks

vBSEO 3.2.23.5.2 - Persistent Cross-Site Scripting via LinkBacks vBSEO - Persistent XSS via LinkBacks http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/ Versions Affected: 3.5.2 & 3.2.2 Most likely all versions Info: A proven success record, vBSEO powers the most optimized forums on t...

Play! Framework Directory Traversal Vulnerability

The Play! Framework is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Remote attackers can use a specially crafted request with directory- traversal sequences to read arbitrary files in the context of the user running the affected...

TomatoCMS 2.0.x - SQL Injection

TomatoCMS 2.0.x - SQL Injection source: https://www.securityfocus.com/bid/40108/info TomatoCMS is prone to a SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues may allow an attacker to...

COms - 'dynamic.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/32459/info COMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of th...

Jetbox CMS 2.1 - '/admin/cms/images.php?orderby' SQL Injection

source: https://www.securityfocus.com/bid/31824/info Jetbox CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...