Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting

Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting Title: Vanilla Tagging Enchanced 1.0.1 Stored XSS Date: 1/6/12 Author: Henry Hoggard Author URL: henryhoggard.co.uk Author Twitter: @henryhoggard Software: Vanilla Version 2.0.18.4 + Tagging Enhanced plugin 1.0.1...

Genium CMS 2012Q2 - Multiple Vulnerabilities

Genium CMS 2012Q2 - Multiple Vulnerabilities Title: ====== Genium CMS 2012|Q2 - Multiple Web Vulnerabilities Date: ===== 2012-05-02 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=517 VL-ID: ===== 517 Introduction: ============= Durch den Einsatz von Genium CMS können S...

MYRE Real Estate Mobile 2012|2 - Multiple Vulnerabilities

Document Title: =============== MYRE Real Estate Mobile 2012|2 - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=516 Release Date: ============= 2012-04-30 Vulnerability Laboratory ID VL-ID: ==================================== 5...

Havalite CMS 1.0.4 - Multiple Vulnerabilities

Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It\\\'s licensed...

Website Toolbox Cross Site Scripting

Exploit Title: Website Toolbox Cross Site Scripting Date: 7.04.2012 Author: Sony Software Link: http://websitetoolbox.com Web Browser : Mozilla Firefox Site : http://insecurity.ro PoC: http://st2tea.blogspot.com/2012/04/website-toolbox-cross-site-scripting.html...

IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability

Document Title: =============== IceBB CMS v1.0.x RC10 - SQL Injection Vulnerability Release Date: ============= 2011-07-08 Vulnerability Laboratory ID VL-ID: ==================================== 108 Product & Service Introduction: =============================== IceBB is a powerful, fast, free, a...

Linux distributor security list destroyed after hacker compromise !

Hackers have compromised a private e-mail list used by Linux and BSD distributors to share information on embargoed security vulnerabilities and used a backdoor to sniff e-mail traffic, according to the moderator of the list. In a note to "Vendor-Sec" members, moderator Marcus Meissner said he...

Anonymous Press Release for Journalists !

Anonymous Press Release for Journalists ! Today Anonymous Hackers Release a new Press Note for all those Journalists, who writing a story, and have come to their website to do research, or pull a quote. AnonNews uses an open-posting concept. Anyone can post to the site, and moderators will approv...

Xnova Legacies 2009.2 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Xnova Legacies 2009.2 CSRF Date: 27/1/2011 Author: @xploitaday Software Homepage: http://www.xnova-ng.org/ Software Link: http://downloads.tuxfamily.org/xnlegacies/releases/xnova-legacies2009.2.tar.gz Version: 2009.2 Vuln file:...

httpdx - 'tolog()' Format String (Metasploit) (1)

$Id: httpdxtologformat.rb 10150 2010-08-25 20:55:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Kusaba X <= 0.9 XSS/CSRF vulnerabilities

========================================== Kusaba X = 0.9 XSS/CSRF vulnerabilities ========================================== Kusaba X suffers XSS and CSRF vulnerabilities that would allow an attacker to take over the web application and possibly the entire server depending on the MySQL...

Kusaba X 0.9 Cross Site Scripting / Cross Site Request Forgery

========================================== Kusaba X . iframes work too The injected script will render and execute when a Moderator or Administrator views the reports. If a Moderator falls victim, the worst case scenario would be cookie stealing followed by session hijacking and account theft. If...

HTTPDX tolog() Function Format String Vulnerability

This module exploits a format string vulnerability in HTTPDX HTTP server. By sending a specially crafted HTTP request containing format specifiers, an attacker can corrupt memory and execute arbitrary code. By default logging is off for HTTP, but enabled for the 'moderator' user via FTP. This...

Discuz! moderation.inc.php 数据库'注射'漏洞

在文件include/moderation.inc.php里代码: $threadlist = $loglist = array; if$tids = implodeids$moderate $query = $db-query"SELECT FROM $tableprethreads WHERE tid IN $tids AND fid='$fid' AND displayorder='0' AND digest='0' LIMIT $tpp"; while$thread = $db-fetcharray$query ... $threadlist$thread'tid' =...

Design/Logic Flaw

moderation.php in MyBB aka MyBulletinBoard before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors...

modcp-xss.txt

====================================================================== Advisory : XSS in modcp index Release Date : June 17th 2008 Application : vBulletin Version : vBulletin 3.7.1 PL1 and lower, vBulletin 3.6.10 PL1 and lower Platform : PHP Vendor URL : http://www.vbulletin.com/ Authors : Jessic...

[waraxe-2008-SA#062] - Multiple Sql Injections in MyBB 1.2.10

waraxe-2008-SA062 - Multiple Sql Injections in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-62.html Target software description: MyBB is a...

waraxe-2008-SA-062.txt

waraxe-2008-SA062 - Multiple Sql Injections in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-62.html Target software description: MyBB is a...

ipb217-xsssql.txt

---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007 ////...

Invision Power Board (IP.Board) 2.1.7 - ACTIVE Cross-Site Scripting SQL Injection

Invision Power Board IP.Board 2.1.7 - ACTIVE Cross-Site Scripting SQL Injection ---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // /...