Javascript: URLs run in privileged context on New Tab page — Mozilla

Security researcher [email protected] reported that if a javascript: URL is selected from the list of Firefox "new tab" page, the script will inherit the privileges of the privileged "new tab" page. This allows for the execution of locally installed programs if a user can be convinced to save a...

nginx+cgi to parse php is prone to a vulnerability-vulnerability warning-the black bar safety net

The title is a bit large, when we analyze carefully after, in fact, are generally configuration issues. If someone wants to attack the server, it will scan the machine where there is vulnerability can upload a malicious script file, the upload script is the first step, When a malicious php script...

Fortigate UTM WAF Appliance - Multiple Vulnerabilities

Document Title: =============== Fortigate UTM WAF Appliance - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=557 Release Date: ============= 2012-08-29 Vulnerability Laboratory ID VL-ID: ==================================== 557...

Fedora 17 : redeclipse-1.2-12.fc17 (2012-11582)

A flaw was found in the way Red Eclipse handled config files. In cube2-engine games, game maps can be transmitted either from the server to a client, or from client to client. These maps include a config file mapname.cfg in 'cubescript' format, which allows for an attacker to send a malicious...

Umbraco codeEditorSave.asmx SaveDLRScript Operation Traversal File Upload Arbitrary Command Execution

The version of Umbraco installed on the remote host allows unauthenticated remote attackers to upload arbitrary files using the 'SaveDLRScript' SOAP action of the 'codeEditorSave.asmx' script. In addition, these files can be stored in a web-accessible location using encoded traversal strings. The...

VamCart CMS 0.9 - Multiple Vulnerabilities

VamCart CMS 0.9 - Multiple Vulnerabilities Title: ====== VamCart v0.9 CMS - Multiple Web Vulnerabilities Date: ===== 2012-06-25 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=622 VL-ID: ===== 622 Common Vulnerability Scoring System: ====================================...

Kaspersky PM 5.0.0.164 - Software Filter Vulnerability

Document Title: =============== Kaspersky PM 5.0.0.164 - Software Filter Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=612 Release Date: ============= 2012-07-12 Vulnerability Laboratory ID VL-ID: ==================================== 612...

Vanilla Forums LatestComment 1.1 Plugin Persistent XSS

Exploit for php platform in category web applications Title: Vanilla LatestComment 1.1 Plugin Persistant XSS Vulnerability Date: 18/5/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 + Latest Comment 1.1...

LAN Messenger v1.2.28 - Persistent Software Vulnerability

Document Title: =============== LAN Messenger v1.2.28 - Persistent Software Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id= Release Date: ============= 2012-05-16 Vulnerability Laboratory ID VL-ID: ==================================== 541...

Car Portal CMS v3.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title: ====== Car Portal CMS v3.0 - Multiple Web Vulnerabilities Introduction: ============= Car Portal is a php software product for running auto classifieds websites. It provides functionality for the private sellers to sign up, list their c...

Car Portal CMS 3.0 - Multiple Vulnerabilities

Car Portal CMS 3.0 - Multiple Vulnerabilities Title: ====== Car Portal CMS v3.0 - Multiple Web Vulnerabilities Date: ===== 2012-04-24 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=502 VL-ID: ===== 502 Introduction: ============= Car Portal is a php software product fo...

Gnuboard 4.34.20 Cross Site Scripting

Exploit Title: gnuboard = 4.34.20 XSS vulnerability via arbitrary file name Date: 2012-03-12 Author: wh1ant Software Link: http://sir.co.kr/bbs/board.php?botable=g4pds&wrid=7108 Version: gnuboard = 4.34.20 Tested on: windows 7 Ultimate K Company: trinitysoft Group: secuholic 1 Vulnerability...

gnuboard <= 4.34.20 XSS vulnerability via arbitrary file name

Exploit for php platform in category web applications Exploit Title: gnuboard = 4.34.20 XSS vulnerability via arbitrary file name Date: 2012-03-12 Author: wh1ant Software Link: http://sir.co.kr/bbs/board.php?botable=g4pds&wrid=7108 Version: gnuboard = 4.34.20 Tested on: windows 7 Ultimate K...

LDAP Account Manager Pro 3.6 跨站脚本和HTML注入漏洞

LDAP Account Manager LAM是一个基于浏览器的LDAP帐号管理系统 LDAP Account Manager LAM存在多个持久型输入校验漏洞，允许攻击者在应用程序段实现恶意脚本代码，成功利用漏洞操作数据或劫持会话user/mod/admin 另外也受客户端跨站脚本漏洞，允许攻击者劫持目标用户/admin会话 0 LDAP Account Manager Pro 3.6 厂商解决方案 目前没有详细解决方案提供： http://lam.sourceforge.net/index.htm...

Unfixed XSS vulnerability at www.musiquemachine.com

Security researcher aSUaBANG, has submitted on 14/02/2012 a cross-site-scripting XSS vulnerability affecting www.musiquemachine.com, which at the time of submission ranked 3750807 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/02/2012. It i...

Sun Microsystems (Print) - Cross Site Scripting Vulnerabilities

Sun Microsystems Print - Cross Site Scripting Vulnerabilities Today Ucha Gobejishvili longrifle0x a Pentester from Georgia reported 3 More important Cross Site Scripting Vulnerabilities in Sun Microsystem's and Java Printer Webpages. Java's Vulnerable Link : Click Here Sun's Vulnerable Link 1 :...

Unfixed XSS vulnerability at estadisticas.idc.enet.cu

Security researcher xDarkSton3x, has submitted on 28/01/2012 a cross-site-scripting XSS vulnerability affecting estadisticas.idc.enet.cu, which at the time of submission ranked 59909 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/02/2012. I...

ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities

Document Title: =============== ATMAIL WebMail v6.3.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=375 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID VL-ID: ==================================== 375...

IBM WebSphere Application Server XSS Vulnerability (Nov 2011)

IBM WebSphere Application Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Nabble Forums Cross Site Scripting

Date: 13.10.2011 Author: Sony Software Link: http://www.nabble.com/ Google Dorks: inurl:NamlServlet.jtp or inurl:/template/NamlServlet.jtp?macro=3D Browser: Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2011/10/nabble-forums-cross-site-scripting.html...