idreamsoft iCMS Cross-Site Scripting Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in idreamsoft iCMS 7.0.7 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the nickname...

CVE-2018-9922: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.php pathname...

PT-2018-19090

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS versions prior to 7.0.8 Description An issue exists where physical path leakage occurs via an invalid nickname field, revealing a core/library/weixin.class.php pathname. Recommendations For idreamsoft iCMS versions prior to...

Mail.ru: XSS в нике при запросе в контакты.

Stored XSS in web.icq.com via nickname in contact add request...

Stored Cross-site Scripting Vulnerability in yiifcms v1.5

yiifcms is a content management system CMS developed on the yii framework. A stored cross-site scripting vulnerability exists in yiifcms v1.5, due to the system failing to strictly filter nickname and personality signature input. Attackers can use this vulnerability to obtain COOKIE information, ...

curl security, bug fix, and enhancement update

7.29.0-42 - fix use of uninitialized variable detected by Covscan 7.29.0-41 - make FTPS work with --proxytunnel 1420327 7.29.0-40 - make FTPS work with --proxytunnel 1420327 7.29.0-39 - work around race condition in PK11FindSlotByName in NSS 1404815 7.29.0-38 - make FTPS work with --proxytunnel...

Malware exploit: Kaiten

Type: Remote Code Execution Author: shipcod3 / Jay Turla This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include...

x5music V2.0 Member Center Injection Vulnerability

x5music Free Edition is an audio-visual management system developed using php+Mysql. x5music V2.0 Free Edition has an injection vulnerability in the member center. As X5music uses a global escape filter, nickname characters are taken out of the database and not processed, resulting in data that c...

Legend Perl IRC Bot - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Legend Perl IRC Bot Remote Code Execution', 'Description' = %q This module exploits a remote command execution on the Legend Perl IR...

Epic 1.0.1/1.0.x CTCP Nickname Server Message Buffer Overrun Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8999/info A remotely exploitable buffer overrun has been reported in Epic. This issue may reportedly be exploited by a malicious server that supplies an overly long nickname in a CTCP messages, potentially allowing for...

PISG 0.54 IRC Nick HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10195/info pisg has been reported prone to an input validation vulnerability. The issue will only present itself when pisg is used to monitor an IRC server that does not place limitations on IRC Nick values that can be...

CVE-2014-0341

Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...

CVE-2014-0341: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...

PT-2014-3572

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.9 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific fields, including the title field to certain template files, an event field, email field, or nickname...

pivotx -- cross-site scripting (XSS) vulnerability

pivotx reports: cross-site scripting XSS vulnerability in the nickname and possibly the email field. Mitigated by the fact that an attacker must have a PivotX account...

程氏舞曲CMS最新php版本高危SQL注入漏洞

简要描述： 注入毫无限制！ 详细说明： 昨天刚下载的源码（应该最新的吧...） bug文件位置：https://images.seebug.org/upload/app/models/csdjskins.php第3466行 function GetIP //定义了一个获取ip地址的函数 if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" //换取ip地址，如果存在，则使用clientip。 $ip = getenv"HTTPCLIENTIP"; else if...

Ra1NX PHP Bot Authentication Bypass Remote Code Execution

Exploit Title: "Ra1NX" PHP Bot pubcall Authentication Bypass Remote Code Execution Date: March 24, 2013 Exploit Author: bwall Software Link: https://defense.ballastsecurity.net/decoding/index.php?hash=69401ac90262f3855c23cd143d7d2ae0 Version: v2.0 Tested on: Ubuntu require 'msf/core' class...

Colloquy 1.3.51.3.6 - Denial of Service

Colloquy 1.3.51.3.6 - Denial of Service !/usr/bin/python3 Wednesday, January 09, 2013 . . | || || | || \ / | / \ / | |/ \ / \ | || || |\ // // | \ / /\ /||/|| / |||| // / http://www.zempirians.com 00100011 01101100 01100101 01100111 01101001 01101111 01101110 -= Colloquy - A Mac OS X Internet...

Colloquy 1.3.5/1.3.6 - Denial of Service

!/usr/bin/python3 Wednesday, January 09, 2013 . . | || || | || \ / | / \ / | |/ \ / \ | || || |\ // // | \ / /\ /||/|| / |||| // / http://www.zempirians.com 00100011 01101100 01100101 01100111 01101001 01101111 01101110 -= Colloquy - A Mac OS X Internet Chat client. =- Proof of Concept, Denial...

LAN Messenger 1.2.28 Cross Site Scripting

Title: ====== LAN Messenger v1.2.28 - Persistent Software Vulnerability Date: ===== 2012-05-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id= VL-ID: ===== 541 Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= LAN...