SQL injection in DefaultReferralManager

In confluence-core/confluence/src/java/com/atlassian/confluence/links/DefaultReferralManager.java the DefaultReferralManager class the deleteReferrersWithPrefix method is vulnerable to sql injection through the user controlled 'prefix' parameter. It is possible to exploit this issue as an Admin...

LinkedIn Clickjacking / Open Redirection

Linkedin's Clickjacking & Open Url Redirection Vulnerabilities Vulnerability Title: Secondary Email Addition & Deletion Via Click Jacking in Linkedin Website Link: Tried on Indian version Found on: 06/08/2012 Author: Ajay Singh Negi Version: All language versions would be vulnerable Tested on:...

ME Mobile Application Manager v10 - SQL Vulnerabilities

Title: ====== ME Mobile Application Manager v10 - SQL Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=628 VL-ID: ===== 628 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

ME Application Manager 10 - Multiple Web Vulnerabilities

Title: ====== ME Application Manager 10 - Multiple Web Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=627 VL-ID: ===== 627 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: =============...

Fedora Update for puppet FEDORA-2012-6674

Check for the Version of puppet OpenVAS Vulnerability Test Fedora Update for puppet FEDORA-2012-6674 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for xen FEDORA-2012-11182

Check for the Version of xen OpenVAS Vulnerability Test Fedora Update for xen FEDORA-2012-11182 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Session ID and remember me cookie should expire when LDAP user password is changed

Steps to reproduce Login as a normal Confluence user In another browser or in incognito mode, login as system administrator Go to Confluence Admin Manage Users and click on the user Click Set Password and set a different password for this user Refresh the page and the user can still access the pa...

ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities

Document Title: =============== ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=667 Release Date: ============= 2012-08-17 Vulnerability Laboratory ID VL-ID: ==================================== 667...

ManageEngine OpStor 7.4 - Multiple Vulnerabilities

Title: ====== ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities Date: ===== 2012-08-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=667 VL-ID: ===== 667 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

ME Application Manager 10 Cross Site Scripting / SQL Injection

Title: ====== ME Application Manager 10 - Multiple Web Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=627 VL-ID: ===== 627 Common Vulnerability Scoring System: ==================================== 7.2 Introduction: =============...

ManageEngine Application Manager 10 - Multiple Vulnerabilities

ManageEngine Application Manager 10 - Multiple Vulnerabilities Title: ====== ME Application Manager 10 - Multiple Web Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=627 VL-ID: ===== 627 Common Vulnerability Scoring System:...

ME Mobile Application Manager 10 SQL Injection

Title: ====== ME Mobile Application Manager v10 - SQL Vulnerabilities Date: ===== 2012-07-04 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=628 VL-ID: ===== 628 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

ME Application Manager 10 - Multiple Web Vulnerabilities

Document Title: =============== ME Application Manager 10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=627 Release Date: ============= 2012-07-03 Vulnerability Laboratory ID VL-ID: ==================================== 62...

ME Application Manager 10 - Multiple Web Vulnerabilities

Document Title: =============== ME Application Manager 10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=627 Release Date: ============= 2012-07-03 Vulnerability Laboratory ID VL-ID: ==================================== 62...

Etomite CMS 1.0 Cross Site Scripting

/. /\ /\ /\ /\ / / // | | \ \ \ \ / / / /// / // / / / /// / // | / / \ | | | http://www.etomite.com/files/file/323-etomite-11/ Versions: 1.0 Tested on: Windows7 ------------------------------------------------------------------------------...

Sysax 5.60 - Create SSL Certificate Buffer Overflow

Sysax 5.60 - Create SSL Certificate Buffer Overflow Title: Sysax Security Settings Configure - Create Certificate - You will get an error, click OK and voila, code execution calc.exe shell32.ll jmp esp 7cb97475...

Sysax <= 5.60 Create SSL Certificate Buffer Overflow

Exploit for windows platform in category local exploits Title: Sysax Security Settings Configure - Create Certificate - You will get an error, click OK and voila, code execution calc.exe shell32.ll jmp esp 7cb97475...

[SECURITY] Fedora 17 Update: drupal6-og-2.3-1.fc17

Enable users to create and manage their own 'groups'...

Pritlog CMS 0.821 Cross Site Scripting

Title: ====== Pritlog v0.821 CMS - Multiple Web Vulnerabilities Date: ===== 2012-04-29 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=534 VL-ID: ===== 534 Introduction: ============= PRITLOG is an extremely simple, small 500K uncompressed and powerful blog system. It...

PicoPublisher 2.0 SQL Injection

Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Demo : http://picopublisher.com/demo/ Dork : intext:"Drives med...