Facebook BugBounty #2 - Persistent Web Vulnerabilities

Document Title: =============== Facebook BugBounty 2 - Persistent Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=239 http://www.vulnerability-lab.com/getcontent.php?id=277 Release Date: ============= 2011-09-19 Vulnerability Laborato...

StarMoney Banking Software - Multiple Vulnerabilities [HD]

Document Title: =============== StarMoney Banking Software - Multiple Vulnerabilities HD References: =========== Download: http://www.vulnerability-lab.com/resources/videos/258.wmv View: http://www.youtube.com/watch?v=Bymh3ct1v4g Release Date: ============= 2011-08-30 Vulnerability Laboratory ID...

8Pixel Blog CMS v4.2 - Cross Site Scripting Vulnerability

Document Title: =============== 8Pixel Blog CMS v4.2 - Cross Site Scripting Vulnerability Release Date: ============= 2011-08-14 Vulnerability Laboratory ID VL-ID: ==================================== 1 Product & Service Introduction: =============================== 8pixel.net developes...

Debian DSA-2291-1 : squirrelmail - various vulnerabilities

Various vulnerabilities have been found in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities : - CVE-2010-4554 SquirrelMail did not prevent page rendering inside a third-party HTML frame, which makes it easier for remote...

SAP Internet Sales - XSS

Application: SAP NetWeaver Vendor URL: Bugs: XSS Risk: High Exploits: YES Reported: 08.04.2011 Vendor response: 08.04.2011 Date of Public Advisory: 17.02.2012 Reference: SAP Security Note 1583300 Description SAP NetWeaver 7.0 Internet Sales crm.b2b has XSS vulnerability. Business Risk An attacker...

Tabnapping Phishing Proof Of Concept

I just stumbled across this credit goes to http://www.pjlantz.com/2010/05/tabnapping.html and Aza Raskin and while rough, certainly has potential given the right circumstances. I added a quick PoC, though I'm on a NAT and can't provide you a working link atm, though it seemed to work fine using t...

Fake antivirus campaign on India's DNA e-newspaper website !

Fake antivirus campaign on India's DNA e-newspaper website ! DNA Daily News and Analysis is an Indian daily English language newspaper. According to Wikipedia, DNA ranks 8th among the top ten English dailies in India. Recently, the Zscaler solution was blocking access to this site, as it containe...

Rajasthan State marketing site infected with malicious code

India's Rajasthan State Co-operative Marketing Federation Ltd https://rajfed.gov.in/ has been infected with a malicious script tag. This government site promotes the objectives of procuring agricultural produce from farmers through the member societies on support prices declared by the Govt. of...

Unfixed XSS vulnerability at www.techgig.com

Security researcher Bhavesh Karodiwal, has submitted on 21/03/2011 a cross-site-scripting XSS vulnerability affecting www.techgig.com, which at the time of submission ranked 17936 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It i...

SAP GUI BAPI Explorer- Unauthorized execution of function

Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs:Unauthorized execution Exploits: YES Reported: 15.02.2011 Vendor response:16.02.2011 Date of Public Advisory:11.11.2011 Author: Dmitriy Chastuchin Description SAP GUI BAPI Explorer has stored XSS which...

XT:Commerce Cross Site Scripting

---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce alertdocument.cookie and place an order. When the administrator opens the order in the backend of the shop, the javascript will be executed. By getting the cookie of the admin, the...

Joomla com_jbjobs Persistent XSS Vulnerability

Exploit for php platform in category web applications ============================================== Joomla comjbjobs Persistent XSS Vulnerability ============================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /,...

Opera Browser Address Bar Spoofing Vulnerability

Opera 是独一无二的网络浏览器, 功能强大，使您上网更高效、更安全、更极速 Opera浏览器地址栏存在欺骗漏洞 Opera 10.60 and lower 厂商补丁： opera ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.opera.com script language="javascript" function pausepd date = new Date; var curDate = null; do var curDate = new Date; whilecurDate-date pd;...

MODx Installation File XSS Vulnerability

Title: MODx Installation File XSS Vulnerability Vendor: MODx Product: MODx CMF Tested Versions: 1.0.3, 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== MODx CMF is prone to a XSS vulnerability caused by unsanitized user inp...

Vecchi & Besso CMS XSS Vulnerabilies

Exploit for php platform in category web applications ==================================== Vecchi & Besso CMS XSS Vulnerabilies ==================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1...

Mass SQL Injection Attack Hits Sites Running IIS

There’s a large-scale attack underway that is targeting Web servers running Microsoft’s IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there’s no clear indication of who’s behind the campaign righ...

Edimax AR-7084GA Router CSRF + Persistent XSS Exploit

Exploit for hardware platform in category web applications ===================================================== Edimax AR-7084GA Router CSRF + Persistent XSS Exploit ===================================================== 25 die"One or more of the parts can't be longer then 25 characters!";...

Chilly CMS Persistent XSS Vulnerability

Exploit for unknown platform in category web applications ======================================= Chilly CMS Persistent XSS Vulnerability ======================================= Vulnerability found in- Admin module email email protected company aksitservices Credit by Pratul Agrawal Software...

IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability

Exploit for unknown platform in category web applications ========================================================= IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability ========================================================= =========== I. Overview =========== During a penetration test...

Facebook for iPhone persistent XSS

================================== Facebook for iPhone persistent XSS ================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 /' /' / /' 0 /, // ,/ / 1 // /' / // /' / /' 0 / / / / / / 1 / / 0 ////// // // // // // 1 / Exploit database...