Timesheet 1.2.1 Blind SQL Injection Vulnerability

About: Timesheet.php is a PHP application designed to keep track of the hours worked by multiple people on multiple projects. It allows users to log in through their web browser and manage the times that they are clocked on or clocked off. Description: A vulnerability can be found on the file...

[Full-disclosure] SmartSiteCMS v1.0 authentication bypass

SmartSiteCMS v1.0 authentication bypass STATUS: I contacted the vendor more than 2 months ago and still no response. TECHNICAL INFO ================================================================ One of the worst cms I've ever seen regarding security, no input sanitation at all. Bypassing...

advisory-355.txt

KAPDA New advisory Vendor: http://myiosoft.com Vulnerable: AjaxPortal v. 3.0 Bug: Sql Injection Authentication Bypass Exploitation: Remote with browser Description: -------------------- AjaxPortal is based on Sajax technology - an open source tool to make programming websites using the Ajax...

[Full-disclosure] RevilloC mail server USER command heap overflow

1-title: Revilloc mail server "USER" command heap overflow Product: Revilloc MailServer and Proxy v 1.21 http://www.revilloC.com The mail server is a central point for emails coming in and going out from home or office The service will work with any standard email client that supports POP3 and...

citibankXSS.txt

------=Part8324496004.1123943920825 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hi Full-Disclosure, I'm here to report an XSS vulnerability in one of Citibank's websites. I actually found this at a log in screen, but it's on...

logicsBS2000.txt

Logics Software Filetransfer from BS2000 Host to Web Client Release Date: April 4, 2005 Date noticed: March 11, 2005 Severity: High verified read access to any file and to-be-verified write access Vendor: Logics Sofware http://www.logics.de http://www.logics.de/bs2000.htm Systems Affected: All...

zpanelFlaws.txt

Hello, Few bugs have been discovered accidently in zPanel. Developers were notified on 07.March but I have not received any response. Best regards, Mikhail. ------------------------------------------------------------- Product Description "ZPanel is a hosting control interface developed for both...

[NOBYTES.COM: #3] osCommerce 2.2-MS2 - XSS Vulnerability

Hello All, I have discovered XSS vulnerability in: osCommerce 2.2-MS2 Authors Site: http://www.oscommerce.com/ +-Example:--------------------------------------------------+ XSS: http://www.victimsite.com/contactus.php?&name=1&email=1&enquiry=3C/textare a3E3Cscript3Ealert'w00t';3C/script3E Result:...

CleanCache v2.19: False Sense of Security

This is a similar if not exact problem that I found with the program Window Washer 5.x by Web Root: http://www.securityfocus.com/archive/1/372717 Publisher: ButtUglySoftware Program Description: CleanCache v.2.19 will clean up your Windows computer, such as IE cache, cookies and temp directories ...

Bug in Opera and Konqueror

/----------------+--------------------------------------+------------- | sp00fed packet | | advisory 2 | +----------------+--------------------------------------+-------------+ | Product: multiply vendors browsers | | Vulnerability: buffer overflow | | Danger: low |...

memberlist.php of vBulletin

vBulletin ALL versions Vendor status: notified 3/18/2; no response Within the first few lines of code in memberlist.php, the variable $letterbits is evaled. Because of the way PHP initializes variables, we can inject HTML, or JavaScript into the document. So by directing a user to, for example:...

Security Update for SQL Server 2017 RTM GDR (KB5063760)

Security issues have been identified in the SQL Server 2017 RTM GDR that could allow an attacker to compromise your system and gain control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer...