PT-2013-4260

Name of the Vulnerable Software and Affected Versions Download Monitor plugin versions prior to 3.3.6.2 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the p parameter in the...

FBI Used Firefox Exploit to Shutdown Illegal Site Running on Tor Network

TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, assassins for hire and other weird and illegal activities can allegedly be traded. A claimed zero-day vulnerability in Firefox 17 was used by the FBI to identify...

Impossible Google Search Queries

Anonymous user asked a question on Quora that, How and Why Google is showing prn results in when one type equation -4^1/4 into Google search query ? This is really a very strange bug on Google. Just after that Jeremy Hoffman, Google software engineer replied him, "Hi, I'm a Google search engineer...

PT-2013-1987

Name of the Vulnerable Software and Affected Versions w-CMS version 2.01 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the p parameter in the getMenus function in codes/wcms.php, or the COMMENT parameter in blog.php, guestbook.php, ...

CVE-2012-6523: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

PT-2013-1986

Name of the Vulnerable Software and Affected Versions w-CMS version 2.01 Description A directory traversal issue exists in the getContent function in codes/wcms.php, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the p parameter. Recommendations F...

Customized variables whose values are hidden passwords are unmasked revealing the password in the build summary

Step to replicate Create two variables passworder and Passworder notice p with caps Run a customize build overridden the contents of the field While the fields remains hidden in the metadata as expected, the variable with capital P has it values revealed in the build summary see screenshot...

CVE-2012-4046: Exposure of Sensitive Information to an Unauthorized Actor

The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the paramR"P" value...

MyBB AJAX Chat - Persistent Cross-Site Scripting

MyBB AJAX Chat - Persistent Cross-Site Scripting Title: MyBB AJAX Chat Persistent XSS Vulnerability Date: 12/12/2012 Exploit Author: Mr. P-teo Vendor Homepage: http://www.mybb.com/ Software Link: http://mods.mybb.com/view/ajax-chat Version: 1 Tested on: Windows The Persistent XSS vulnerability li...

MyBB AJAX Chat - Persistent Cross-Site Scripting

Title: MyBB AJAX Chat Persistent XSS Vulnerability Date: 12/12/2012 Exploit Author: Mr. P-teo Vendor Homepage: http://www.mybb.com/ Software Link: http://mods.mybb.com/view/ajax-chat Version: 1 Tested on: Windows The Persistent XSS vulnerability lies within the chatframe.php page. Persistent /...

Fedora 16 : rt3-3.8.15-1.fc16 (2012-17218)

---------------------------------------------------------------------- ---------- ChangeLog : - Sun Oct 28 2012 Ralf Corsepius - 3.8.15-1 - Upstream update RH BZ 870407, CVE-2012-4730, CVE-2012-4732, CVE-2012-4734, CVE-2012-4735, CVE-2012-4884. - Sat Oct 6 2012 Ralf Corsepius - 3.8.14-1 - Upstrea...

PT-2012-5715

Name of the Vulnerable Software and Affected Versions AneCMS affected versions not specified Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter in the "acp/index.php" endpoint. Recommendations At the moment, there is no...

CVE-2012-4997: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. dot dot in the p parameter...

Potential remote code execution due to embedding of old django-piston

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46819. panel The exposed atlassian api for forummodules found under forummodules/atlassian/api uses an outdated version of...

CVE-2012-4055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter...

PT-2012-5174

Name of the Vulnerable Software and Affected Versions Uiga Personal Portal affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the p parameter in the "index2.php" API endpoint. Recommendations At the moment, there i...

PT-2012-5173

Name of the Vulnerable Software and Affected Versions Uiga Fan Club affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the p parameter in the "index2.php" endpoint. Recommendations At the moment, there is no...

CVE-2012-4056: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter...

PT-2012-5029

Name of the Vulnerable Software and Affected Versions Quick.CMS version 4.0 Description A cross-site scripting XSS issue exists in the default index page in admin/ due to improper validation of user input. This allows remote attackers to inject arbitrary web script or HTML via the p parameter in...

CVE-2012-3833: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter...