Sql injection

SQL injection vulnerability in the JS Calendar comjscalendar component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the evid parameter in a details action to index.php. NOTE: some of these details are obtained from third party information...

CVE-2010-4794

Multiple cross-site scripting XSS vulnerabilities in the JoomlaSeller JS Calendar comjscalendar component 1.5.1 and 1.5.4 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 month and 2 year parameters in a jscalendar action to index.php. NOTE: some of these detail...

CVE-2010-4794

Summary (CVE-2010-4794) : The Joomla! component JoomlaSeller JS Calendar (com_jscalendar) for Joomla! versions 1.5.1 and 1.5.4 contains multiple XSS vulnerabilities. An attacker can inject arbitrary JavaScript/HTML via the (1) month and (2) year parameters in a jscalendar action to index.php, ena...

CVE-2010-4795

CVE-2010-4795: A SQL injection vulnerability affects the Joomla! JS Calendar (com_jscalendar) component versions 1.5.1 and 1.5.4. The flaw allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php. Underlying issue is improper handling of u...

CVE-2010-4795

SQL injection vulnerability in the JS Calendar comjscalendar component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the evid parameter in a details action to index.php. NOTE: some of these details are obtained from third party information...

Host-Extract - Host/IP Pattern Extractor Tool !

Host-Extract - Host/IP Pattern Extractor Tool ! This little ruby script tries to extract all IP/Host patterns in page response of a given URL and JavaScript/CSS files of that URL. With it, you can quickly identify internal IPs/Hostnames, development IPs/ports, cdn, load balancers, additional...

ClubHack : CHMag Issue 14th, March 2011 Download !

ClubHack : CHMag Issue 14th, March 2011 Download ! Description: 14th issue of ClubHACK magazine is out. Contents of this issue: Tech Gyan - Remote Thread Execution in System Process Tool Gyan - JS Recon: Java Script Network Reconnaissance Tool Mom's Guide - Choosing Right Secure Mobile Legal Gyan...

Anonymous Hackers announce Operation Italy ( #OPITALY ) on 13.02.2011 at 9am GMT (10.00 italian time)

Anonymous Hackers announce Operation Italy OPITALY on 13.02.2011 at 9am GMT 10.00 italian time Press Release : Operation Iran - Press release by Anonymous Hackers LOIC : Mobile/Js LOIC : Reasons : Cables : Source : Google...

webkitgtk security update

1.2.6-2 - Added fix for js regression 1.2.6-1 - Update to 1.2.6...

Xinhua enterprise web site management system v4. 0 XSS0day add administrator and patch-vulnerability warning-the black bar safety net

From:B0mbErM@n Description:online repair function is not to submit the filter Analysis:xiu. asp not be submitted to the filter, resulting in execution of arbitraryXSSstatement. Patch:filter Exp: ../xiu. the asp directly into the repair, then at the contact address written on the SCRIPT...

Joomla! Component JSupport 1.5.6 - Cross-Site Scripting

Joomla! Component JSupport 1.5.6 - Cross-Site Scripting Exploit Title: Joomla Component comjsupport Critical XSS Vulnerability Date: 12.11.2010 Author: Valentin Category: webapps/0day Version: 1.5.6 Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1...

Joomla JSupport 1.5.6 Cross Site Scripting

Exploit Title: Joomla Component comjsupport Critical XSS Vulnerability Date: 12.11.2010 Author: Valentin Category: webapps/0day Version: 1.5.6 Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title =...

Mozilla dangling pointer vulnerability in LookupGetterOrSetter

The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly support window.lookupGetter function calls that lack arguments, which allows remote attackers to...

JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities

JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities Name JS Calendar Vendor http://www.joomlaseller.com Versions Affected 1.5.1 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-10-09 X. INDEX I. ABOUT T...

Joomla! Component JS Calendar 1.5.1 - Multiple Vulnerabilities

Joomla! Component JS Calendar 1.5.1 - Multiple Vulnerabilities JS Calendar 1.5.1 Joomla Component Multiple Remote Vulnerabilities Name JS Calendar Vendor http://www.joomlaseller.com Versions Affected 1.5.1 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact...

Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)

$Id: adobeu3dmeshdecl.rb 10477 2010-09-25 11:59:02Z mc $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Code injection

phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...

Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (1)

$Id: adobeflatedecodepredictor02.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Ecshop2.7.2持久型XSS（可获得管理员帐号）

简要描述： 个人资料修改时，Javascript代码过滤不够严格，XSS代码直接进入数据库 详细说明： 密码保护问题这一项，没有使用正则过滤，其他的的都有正则过滤。我们可以在密码保护问题里输入XSS，但是后台查看会员资料是不显示密码保护问题的，所以这里必须要网站后台添加了新的 “会员注册项”时，后台查看资料就会显示了，此处填入一段引入外部js的代码:" 外部test.js文件内容如下 Ajax.call'privilege.php?act=update','id=1&username=heihei&[email protected]','',"POST","JSON"; 漏洞证明：...

Joomla! Component Restaurant Guide 1.0.0 - Multiple Vulnerabilities

Joomla! Component Restaurant Guide 1.0.0 - Multiple Vulnerabilities Exploit Title: Joomla Component comrestaurantguide Multiple Vulnerabilities Date: 18.09.2010 Author: Valentin Category: webapps/0day Version: 1.0.0 Tested on: Debian lenny, Apache2, MySQL 5, Joomla 1.5.x CVE : Code :...