808 matches found
The vulnerability of the iOS operating system, which allows a perpetrator to initiate certain processes
The vulnerability of the WebKit component of the iOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to initiate certain processes by manipulating URLs such as tel://, facetime://, and facetime-audio://...
Thumbnail Carousel Slider < 1.0.1 - Authenticated Shell Upload & CSRF
The original advisory states that this vulnerability is exploitable with editor and author roles but this is incorrect. Only the administrator role by default can trigger this vulnerability. However, CSRF on the image upload form makes this exploitable by a malicious actor. Create a file named...
Device Inspector 1.5 Command Injection
Document Title: =============== Device Inspector v1.5 iOS - Command Inject Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1558 Release Date: ============= 2015-08-07 Vulnerability Laboratory ID VL-ID: ====================================...
Vimeo: A user can add videos to other user's private groups
It is possible for a user to add videos to other user's private groups. Steps to verify: 1. Log into vimeo.com as Alice. Create a new group lets say, AlicePrivateGroup with group id 301924 and choose 'Only members can see this group' setting. 2. Login as Bob and create a new group lets say,...
Mambo Site Server 4.0.12 RC2 Cookie Validation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6926/info Mambo Site Server may grant access without sufficiently validating cookie based authentication credentials. It has been reported that Mambo will accept a user cookie sent by the site as an administrative...
chCounter indirect SQL Injection and XSS Vulnerabilities
No description provided by source. Exploit Title: chCounter indirect SQL Injection and XSS Vulnerabilities Date: 29.04.2010 Author: Valentin Category: webapps/0day Version: 3.1.1 Tested on: Debian, Apache2, PHP5, MySQL5 CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1...
openSUSE Security Update : MozillaFirefox (openSUSE-SU-2010:0632-1)
Mozilla Firefox was updated to version 3.6.10, fixing various bugs and security issues. Following security issues were fixed: MFSA 2010-49 / CVE-2010-3169: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. So...
jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities
Document Title: =============== jDisk stickto v2.0.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1196 Release Date: ============= 2014-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 11...
Mobile Atlas Creator 1.9.12 - Command Inject Vulnerability
Document Title: =============== Mobile Atlas Creator 1.9.12 - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=945 Release Date: ============= 2013-09-08 Vulnerability Laboratory ID VL-ID: ====================================...
Download Lite 4.3 Cross Site Scripting
Title: ====== Download Lite v4.3 iOS - Persistent File Web Vulnerability Date: ===== 2013-07-19 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1023 VL-ID: ===== 1023 Common Vulnerability Scoring System: ==================================== 3.5 Introduction: ===========...
Photodex ProShow Producer 5.0.3297 - '.pxs' Memory Corruption
!/usr/bin/python Exploit Title: Photodex ProShow Producer v5.0.3297 .pxs Memory Corruption Vulnerability Version: = 5.0.3297 Date: 2013-02-14 Author: Julien Ahrens @MrTuxracer Homepage: http://www.inshell.net Software Link: http://www.photodex.com Tested on: Windows XP SP3 Professional German...
[CVE-2012-3373] Apache Wicket XSS vulnerability via manipulated URL parameter
Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.4.x and 1.5.x Description: https://wicket.apache.org/2012/09/06/cve-2012-3373.html It is possible to inject JavaScript statements into an ajax link by adding an encoded null byte to a URL pointing to a...
K-Meleon Browser 1.5.4 Denial of Service
Exploit for windows platform in category dos / poc Title: ====== K-Meleon Browser v1.5.4 - Denial of Service Vulnerability Introduction: ============= K-Meleon is an extremely fast, customizable, lightweight web browser based on the Gecko layout engine developed by Mozilla which is also used by...
K-Meleon Browser v1.5.4 - Denial of Service Vulnerability
Document Title: =============== K-Meleon Browser v1.5.4 - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=510 Release Date: ============= 2012-04-13 Vulnerability Laboratory ID VL-ID: ==================================== 5...
Info Fisier 1.0 - SQL Injection
Info Fisier 1.0 - SQL Injection ==================================================================================== + Info Fisier 1.0 SQL Injection Vulnerability + Software : Info Fisier 1.0 + Author : AnGrY BoY + Contact : [email protected] & [email protected] + Home :...
SuSE9 Security Update : perl-Archive-Zip (YOU Patch Number 9462)
Mail virus scanners like amavis use perl-Archive-Zip to scan ZIP archives. A bug in the handling of files with manipulated size entires has been fixed that could leave malicious code in such files undetected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin...
Ubuntu Update for firefox vulnerabilities USN-546-1
Ubuntu Update for Linux kernel vulnerabilities USN-546-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5461.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox vulnerabilities USN-546-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...
Buffer overflow
Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service segmentation fault via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers...
