SolarWinds Storage Manager AuthenticationFilter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AuthenticationFilter class. The issue lies in the ability to subvert th...

Security Advisory-CSRF Vulnerability in Huawei HiLink Products

Several Huawei HiLink products have the CSRF Vulnerability. When users use these devices to visit websites that contain malicious scripts, the malicious scripts can exploit the vulnerability to change the configurations or use the functions of products. Vulnerability ID: HWPSIRT-2014-0243 This...

Winn Guestbook 2.4.8c - Stored XSS Vulnerability

No description provided by source. Exploit Title: Winn Guestbook v2.4.8c Stored XSS Date: 12/29/11 Author: G13 Software Link: http://code.google.com/p/winn-guestbook/, http://www.winn.ws Version: 2.4.8c Category: webapps php CVE: 2011-5026 Vulnerability There is no sanitation on the input of the...

APC ActionApps CMS 2.8.1 - Remote File Include Vulnerabilities

No description provided by source. DEVIL TEAM THE BEST POLISH TEAM APC ActionApps CMS 2.8.1 - Remote File Include Vulnerabilities Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl site:...

ASPPlayground.NET 3.2 SR1 Remote Arbitrary File Upload Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14070/info ASPPlayground.NET is prone to a remote arbitrary file-upload vulnerability. Exploiting this issue may allow remote attackers to upload arbitrary files including malicious scripts and possibly execute the script...

Sage 1.0 beta 3 Content Management System Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6894/info Sage is prone to a cross site scripting vulnerability. This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting...

YaPiG 0.92 Remote Server-Side Script Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10891/info A vulnerability is reported to exist in YaPiG that may allow a remote attacker to execute malicious scripts on a vulnerable system. This issue exists due to a lack if sanitization of user-supplied data. It is...

PHPay 2.2 Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7310/info It has been reported that user-supplied input to phPay is not sufficiently sanitized. This lack of sanitization provides an opportunity for an attacker to launch cross-site scripting attacks. It is possible for ...

Inktomi Traffic Server 4.0/5.x Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7596/info Inktomi Traffic Server is prone to a cross-site scripting vulnerability. This is due to insufficient sanitization of input passed to the proxy, which will be echoed back in error pages under some circumstances. ...

Apache HTTP Server Header Injection Cross-Site Scripting (CVE-2006-3918)

A Cross-Site Scripting vulnerability has been reported in Apache HTTP servers. The vulnerability is due to lack of sanitization for data supplied in the HTTP request header. A remote attacker can exploit this vulnerability by sending an HTTP request containing crafted request header to the target...

Serena Dimensions CM跨站脚本漏洞

Bugtraq ID:65976 CVE ID:CVE-2014-0335 Serena Dimensions CM是一款项目计划管理工具。 Serena Dimensions CM存在多个跨站脚本漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Serena Dimensions CM 12.2 Build 7.199.0 web client 目前没有详细解决方案提供： http://www.serena.com/index.php/en/products/featured-products/dimensions-cm/...

Rnet eShop Cross Site Scripting

\ \ / / / | / | \ V / | | alert1; http://www.glamourtopz.com/adminlogin.asp?e=&n= "/alert1; http://www.smart-alarm.no/adminlogin.asp?e=&n= "/alert1; http://www.testselv.no/adminlogin.asp?e=&n="/alert1; http://www.urmaker-ronning.no/adminlogin.asp?e=&n= "/alert1;...

IBM SPSS Data Collection CVE-2013-0464跨站脚本漏洞

Bugtraq ID:60246 CVE ID:CVE-2013-0464 IBM SPSS Data Collection是全球业界领先的问卷调查、市场研究以及客户行为分析的专业解决方案。 IBM SPSS Data Collection存在一个输入验证漏洞，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被用户查看时可获取敏感信息或劫持用户会话。 0 IBM SPSS Data Collection 6.0.1 IBM SPSS Data Collection 6.0 IBM SPSS Data Collection 7.0 用户可参考如下厂商提供的安全公告获得补丁程序：...

Passenger passenger witkey system CSRF+getshell-a vulnerability warning-the black bar safety net

Registered members 2, The http://127.0.0.1/index.php?do=user&view=message&msgtype=write 3, is sent to the admin, the following is a csrf, the purpose is to add an administrator account kppw password kppwkppw script src=http://127.0.0.1/control/admin/index. php?...

OpenDocMan 1.2.6.5 - Persistent Cross-Site Scripting

Exploit Title: OpenDocMan 1.2.6.5 Stored/Reflective XSS Date: 05/04/2013 Exploit Author: drone @dronesec More Exploit Information: Vendor Homepage: http://www.opendocman.com/ Software Link: http://sourceforge.net/projects/opendocman/files/opendocman/1.2.6.5/opendocman-1.2.6.5.zip/download Version...

[Converter v0.7] Analyzing and Deobfuscating Malicious Scripts

Malicious Java applets have been making news for awhile so I thought I would update Converter to include some new features to help with deobfuscating them. This is a list of changes made to this version: + Replaced Binary-to/from-Text with Binary-to/from-Hex to make it more useful + Added Filter...

FortiMail IBE - Exception & Filter Bypass Vulnerability

Document Title: =============== FortiMail IBE - Exception & Filter Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=772 Download: http://www.vulnerability-lab.com/resources/videos/772.wmv View: http://www.youtube.com/watch?v=5d7cIaM80oY Advisory:...

OrangeHRM 2.7.1 Vacancy Name Persistent XSS

OrangeHRM1 2.7.12 -- the latest stable release as of this writing -- suffers from a persistent XSS in the vacancy name variable. Steps: 1. Navigate to following URL: http://domain/symfony/web/index.php/recruitment/viewJobVacancy 2. Add or Edit a Vacancy 3. In the Vacancy Name parameter put XSS...

Vulnerability in HTC website allow attacker to hijack accounts

Thamatam Deepak Mr.47™ reported a Cross site scripting XSS Vulnerability and cookie handling in HTC website, that allow an attacker to HTC website hijack accounts. Mr. Deepak is a 16 years old whitehat hacker, listed in Apple Hall of Fame with 'The Hacker News' researcher Mohit Kumar this month...

XSS Vulnerability in Apple website

A 16 years old Spanish Whitehat hacker going by name "The Pr0ph3t" found XSS Vulnerability on Apple website. The Vulnerability reported in Apple subdomain - https://locate.apple.com, where users can choose a service center location. About Cross site scripting : Cross-Site Scripting attacks are a...