Facebook BugBounty #2 - Persistent Web Vulnerabilities

Document Title: =============== Facebook BugBounty 2 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=239 http://www.vulnerability-lab.com/getcontent.php?id=277 Release Date: ============= 2011-09-19 Vulnerability Laborato...

Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability

Summary Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advanced easy to use yet fully featured program that can be integrated with any existing site. It takes 2 minuets to install even for non technical users. Description...

Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection

Summary Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advanced easy to use yet fully featured program that can be integrated with any existing site. It takes 2 minuets to install even for non technical users. Description...

iGallery Plugin v1.0.0 (dir) Remote Cross-Site Scripting Vulnerability

Summary iGallery uses MooTools - image resizing done dynamically using phpThumb - resized images are cached. Description iGallery suffers from a XSS vulnerability when parsing user input to the 'dir' parameter via GET method in '/scripts/pthumb/demo/phpThumb.demo.random.php'. Attackers can exploi...

iManager Plugin v1.2.8 (dir) Remote Cross-Site Scripting Vulnerability

Summary With iManager you can manage your files/images on your webserver, and it provides user interface to most of the phpThumb functions. It works either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor. Description iManager suffers from a XSS...

iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability

Exploit for php platform in category web applications iBrowser Plugin v1.4.1 lang Local File Inclusion Vulnerability Vendor: net4visions.com Product web page: http://www.net4visions.com Affected version: lang.'.php' ; 70: $this - charset = $langcharset; 71: $this - dir = $langdirection; 72: $this...

iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability

Summary iBrowser is an image browser plugin for WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor developed by net4visions. It allows image browsing, resizing on upload, directory management and more with the integration of the phpThumb image library. Description iBrowser suffers...

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability

Summary With iManager you can manage your files/images on your webserver, and it provides user interface to most of the phpThumb functions. It works either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor. Description Input passed to the 'd' paramete...

SiT! Support Incident Tracker 3.64 XSS / XSRF / SQL Injection

Vulnerability ID: HTB23043 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinsitsupportincidenttracker.html Product: SiT! Support Incident Tracker Vendor: The Support Incident Tracker Project http://sitracker.org/ Vulnerable Version: 3.64 and probably prior Tested Version: 3.64...

Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities

Document Title: =============== Argus Surveillance DVR v2.3 & 4.x - Multiple Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 227 Abstract Advisory Information: ============================== Vulnerability Lab Team...

GeoVision DVR Remote View - Multiple Web Vulnerabilities

Document Title: =============== GeoVision DVR Remote View - Multiple Web Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 51 Product & Service Introduction: =============================== Geovision is a very famous...

La Poste FR Website - Local File Include Vulnerability

Document Title: =============== La Poste FR Website - Local File Include Vulnerability Release Date: ============= 2011-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 266 Product & Service Introduction: =============================== La Poste is the mail service of...

[slackware-security] httpd

Not long ago, httpd package updates were issued to clamp down on a denial of service bug that's seen some action in the wild. New packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current. Here are the details from the Slackware 13.37 ChangeLog:...

XSS in Zikula

Vulnerability ID: HTB23039 Reference: https://www.htbridge.ch/advisory/xssinzikula.html Product: Zikula Application Framework Vendor: Zikula Software Foundation http://zikula.org/ Vulnerable Version: 1.3.0, build 3168 and probably prior Tested Version: 1.3.0, build 3168 Vendor Notification: 17...

Zikula 1.3.0 Cross Site Scripting

Vulnerability ID: HTB23039 Reference: https://www.htbridge.ch/advisory/xssinzikula.html Product: Zikula Application Framework Vendor: Zikula Software Foundation http://zikula.org/ Vulnerable Version: 1.3.0, build 3168 and probably prior Tested Version: 1.3.0, build 3168 Vendor Notification: 17...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 13.0, 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/mozilla-thunderbird-3.1.13-i486-1slack13.37.txz: Upgraded. This release contains security fixes and...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 13.0, 13.1, 13.37, and -current to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/mozilla-firefox-6.0.2-i486-1slack13.37.txz: Upgraded. This release contains security fixes and improvements. F...

StarMoney Banking Software v8.0 - Multiple Vulnerabilities

Document Title: =============== StarMoney Banking Software v8.0 - Multiple Vulnerabilities References Source: ==================== Download: http://www.vulnerability-lab.com/resources/videos/258.wmv View: http://www.youtube.com/watch?v=Bymh3ct1v4g Release Date: ============= 2011-08-31...

BitDefender IS2011 - FV Buffer Overflow Vulnerability

Document Title: =============== BitDefender IS2011 - FV Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=147 Release Date: ============= 2011-08-29 Vulnerability Laboratory ID VL-ID: ==================================== 147...

BitDefender IS2011 - FV Buffer Overflow Vulnerability

Document Title: =============== BitDefender IS2011 - FV Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=147 Release Date: ============= 2011-08-29 Vulnerability Laboratory ID VL-ID: ==================================== 147...