vBulletin 4.1.12 SQL Information Disclosure

No description provided by source. TITLE ....... vBulletin 4.1.12 - sql information leak for logged-in users DATE ........ 03.05.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://www.vbulletin.com VERSION ..... 4.1.12 TESTED ON ... LAMP...

vBulletin 4.1.12 SQL Information Disclosure

TITLE ....... vBulletin 4.1.12 - sql information leak for logged-in users DATE ........ 03.05.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://www.vbulletin.com VERSION ..... 4.1.12 TESTED ON ... LAMP ----------------------------------------------------------------------- 1. Wh...

vBulletin 4.1.12 Path Disclosure

TITLE ....... vBulletin 4.1.12 - information disclosure for logged in users DATE ........ 30.04.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://vbulletin.com VERSION ..... TESTED ON ... LAMP ----------------------------------------------------------------------- 1. What is thi...

Concrete CMS 5.5.2.1 Logged-In Cross Site Scripting

TITLE ....... Concrete5.5.2.1 CMS is vulnerable to XSS for logged-in users DATE ........ 23.04.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http://concrete5.org VERSION ..... 5.5.2.1 TESTED ON ... LAMP ----------------------------------------------------------------------- 1. What...

SENCHA SNS vulnerable to cross-site request forgery

Overview SENCHA SNS contains a cross-site request forgery vulnerability. SENCHA SNS is an open source SNS software. SENCHA SNS contains a cross-site request forgery vulnerability. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC coordinated with the develope...

Multiple vulnerabilities in OpenEMR

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in OpenEMR, which can be exploited to perform local file inclusion and arbitrary command execution attacks. 1 Multiple Local File Inclusion vulnerabilities in OpenEMR: CVE-2012-0991 1.1 Input passed via the "formnam...

Microsoft PowerPoint Insecure Library Loading (MS11-094; CVE-2011-3396)

A remote code execution vulnerability has been reported in Microsoft PowerPoint. The vulnerability is due to an error in the way Microsoft PowerPoint restricts the path used for loading external libraries. A remote attacker could exploit this vulnerability by enticing a user to open a legitimate...

Juniper Networks IVE ActiveX Control Buffer Overflow (CVE-2006-2086)

A buffer overflow vulnerability has been reported in Juniper Networks IVE. The vulnerability is due to a boundary error within an ActiveX control. A remote attacker may exploit this vulnerability by enticing an affected user to open a specially crafted web-page. Successful exploitation would allo...

Tom Sawyer ActiveX Control Memory Corruption (CVE-2011-2217)

A code execution vulnerability has been reported in Tom Sawyer. The vulnerability is due to an error while instantiating the ActiveX control in a browser. A remote attacker may exploit this vulnerability by enticing a user to open a specially crafted web-page. Successful exploitation of this...

CVE-2011-1774

creationtimestamp| type| source ---|---|--- 2011-10-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/17993 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/safarixsltoutput.rb 2018-05-29 15:50:33+00:00|...

Adobe Reader JPEG Marker Code Execution (APSB11-24; CVE-2011-2440)

A code execution vulnerability has been reported in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing corrupted PDF files. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file. Successful exploitation would allo...

WordPress Super CAPTCHA plugin <= 2.2.4 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Super CAPTCHA plugin = 2.2.4 SQL Injection Vulnerability Date: 2011-08-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/super-capcha.2.2.4.zip Version: 2.2.4 tested...

WordPress Collision Testimonials plugin <= 3.0 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Collision Testimonials plugin = 3.0 SQL Injection Vulnerability Date: 2011-08-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/collision-testimonials.zip Version: 3.0...

Samba Web Administration Tool vulnerable to cross-site scripting

Overview Samba Web Administration Tool contains a cross-site scripting vulnerability. Samba Web Administration Tool SWAT allows for Samba configuration through a web interface. SWAT contains a cross-site scripting vulnerability. SWAT is disabled in a default configuration of Samba. nobuhiro tsuji...

Internet Explorer Window Open Race Condition (MS11-057; CVE-2011-1257)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. A remote attacker could exploit this issue to cause a memory corruption in a way that will enable him to execute arbitrary code in the context of the logged-on user. Successful exploitation of this vulnerabili...

Plone vulnerable to cross-site scripting

Overview Plone contains a cross-site scripting vulnerability. Plone is an open source content management system CMS. Plone contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

Local file inclusion vulnerability and code execution.

PMASA-2011-11 Announcement-ID: PMASA-2011-11 Date: 2011-07-23 Summary Local file inclusion vulnerability and code execution. Description In the 'relational schema' code a parameter was not sanitized before being used to concatenate a class name. Severity We consider this vulnerability to be...

SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities

This module uses the PHPass hashing library to try to store users hashed passwords securely. The module sets a fixed string for the 'pass' column in the users database column but does not replace the pass attribute of the account object used for password reset links. This leads to a vulnerability...

Cybozu Office vulnerable to cross-site scripting

Overview Cybozu Office contains a cross-site scripting vulnerability. Cybozu Office is a groupware. Cybozu Office contains a cross-site scripting vulnerability due to issues contained in the address book and user list functions. NetAgent Co.,Ltd. reported this vulnerability to IPA. JPCERT/CC...

EC-CUBE vulnerable to cross-site request forgery

Overview EC-CUBE provided by LOCKON CO.,LTD. contains a cross-site request forgery vulnerability. EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a cross-site request forgery vulnerability. Masako Oono reported this vulnerability to IP...