Contact Form Maker Component SQL Injection Vulnerability

Joomla! is an open source content management system that provides RSS feeds, site search, etc. Contact Form Maker is a component for creating submission forms. A SQL injection vulnerability exists in the Joomla! Contact Form Maker component that can be exploited by remote attackers to submit a...

RubyGems Paperclip Input Validation Vulnerability

RubyGems Paperclip is a file attachment management library for Active Record. RubyGems Paperclip fails to adequately filter user-submitted input, allowing remote attackers to manipulate pages and spoof content...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

WMAPM 3.1 Privilege Escalation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8995/info wmapm has been reported prone to a local privilege escalation vulnerability. The vulnerability has been conjectured to result from a lack of relative path usage while the vulnerable dock app is invoking a third...

Upclient 5.0 b7 Command Line Argument Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7703/info upclient has been reported prone to a buffer overflow vulnerability when handling command line arguments of excessive length. It is possible for a local attacker to seize control of the vulnerable application an...

Kloxo-MR 6.5.0 - CSRF Vulnerability

No description provided by source. Exploit Title :Kloxo-MR 6.5.0 CSRF Vulnerability Vendor Homepage :https://github.com/mustafaramadhan/kloxo/tree/dev Version :Kloxo-MR 6.5.0.f-2014020301 Tested on :Centos 6.4 Exploit Author :Necmettin COSKUN =@babayarisi Blog :http://www.ncoskun.com...

MultiCart 1.0 - Remote Blind SQL Injection Exploit

No description provided by source. Indonesian Newhack Security Advisory ------------------------------------ MultiCart 1.0 Remote Blind SQL Injection Waktu : Sep 30 2007 02:00AM Software : MultiCart 1.0 Vendor : http://www.iscripts.com/multicart/ Ditemukan oleh : k1tk4t | http://newhack.org Lokas...

PHPNuke 5.6/6.x Banners.PHP Banner Manager Password Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7170/info It has been reported that an input validation error exists in the banners.php file included with PHPNuke. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker ...

UtilMind Solutions Site News 1.1 Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11126/info Reportedly UtilMind Solutions Site News is affected by an authentication bypass vulnerability. This issue is due to an access validation error. An unauthenticated attacker can leverage this issue to display and...

PHPCart Input Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13406/info PHPCart is prone to a remote input validation vulnerability. The issue exists because the software fails to sufficiently sanitize URI parameter data that is employed when computing product charges. A remote...

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery

Motorola SBG901 Wireless Modem - Cross-Site Request Forgery Exploit Title : Motorola SBG901 Wireless Modem CSRF Vulnerability Google dork : N/A Exploit Author: Blessen Thomas Date : 06/01/2014 Vendor Homepage : http://www.arrisi.com/modems/ Software Link : N/A Version : Motorola SBG901 Wireless...

CVE-2012-0871

The sessionlinkx11socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/...

Fedora Update for ImageMagick FEDORA-2014-4969

Check for the Version of ImageMagick OpenVAS Vulnerability Test Fedora Update for ImageMagick FEDORA-2014-4969 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

D-Link DIR-600L跨站请求伪造漏洞

D-Link DIR-600L是款无线路由器产品。 D-Link DIR-600L修订版A1固件版本1.0、修订版B1固件版本2.0，没有正确检查某些请求的合法性，这可使某些用户通过HTTP请求执行未授权操作。 0 D-Link DIR-600L 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.dlink.com/ Exploit Title: Dlink DIR-600L Hardware Version AX Firmware Version 1.00 CSRF Vulnerability Google Dork:...

CVE-2014-0094

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method...

couponPHP CMS 1.0 - Multiple Stored XSS and SQL Injection Vulnerabilities

couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters 'iDisplayLength' and 'iDisplayStart' in 'commentspaginate.php' and 'storespaginate.php' scripts are not properly sanitised before being returned to the user or used in SQL queries. This can be...

Hewlett-Packard Intelligent Management Center SOM euAccountService Servlet Authentication Bypass Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOM's euAccountService servlet. No authentication is required to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Shareaholic SexyBookmarks plugin 6.1.4.0 for WordPress allows remote attackers to hijack the authentication of users for requests that "manipulate plugin settings."...

Ubuntu Update for icedtea-web USN-1804-1

Check for the Version of icedtea-web OpenVAS Vulnerability Test $Id: gbubuntuUSN18041.nasl 8448 2018-01-17 16:18:06Z teissa $ Ubuntu Update for icedtea-web USN-1804-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : icedtea-web vulnerabilities (USN-1804-1)

Jiri Vanek discovered that IcedTea-Web would use the same classloader for applets from different domains. A remote attacker could exploit this to expose sensitive information or potentially manipulate applets from other domains. CVE-2013-1926 It was discovered that IcedTea-Web did not properly...