GLSA-200909-06 : aMule: Parameter injection

The remote host is affected by the vulnerability described in GLSA-200909-06 aMule: Parameter injection Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact : A remote attacker could entice a user to download a file with a specially crafted file nam...

aMule: Parameter injection

Background aMule is an eMule-like client for the eD2k and Kademlia networks, supporting multiple platforms. Description Sam Hocevar discovered that the aMule preview function does not properly sanitize file names. Impact A remote attacker could entice a user to download a file with a specially...

Perl$hop e-commerce Script Trust Boundary Input Parameter Injection

Exploit for cgi platform in category web applications =================================================================== Perl$hop e-commerce Script Trust Boundary Input Parameter Injection =================================================================== A while back I was playing around with...

Perl$hop e-commerce Script Trust Boundary Input Parameter Injection

No description provided by source. A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a lot of vulnerabilities for one...

Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection

Perl$hop E-Commerce Script - Trust Boundary Input Parameter Injection A while back I was playing around with Perl$hop, which if you are not aware, is an e-commerce script developed by Waverider Systems. XSS Cross Site Scripting, Directory Traversal, Code Execution, and more! Wow, that sure is a l...

CVE-2009-2156

Multiple cross-site scripting XSS vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Title field to requests.php, related to viewrequests.php; and 2 the Torrent Name field to torrents-upload.php, related to the logging o...

Directory traversal

Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 rowmysqlblockscenterdownfile parameter to includes/blockcenterdown.php; 2 rowmysqlblockscentertopfile includes/parameter to blockcentertop.php...

[DSECRG-09-013] IBM WebSphere Application Server 7.0 Multiple XSS Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-013 !!! official advisory: !!! http://dsecrg.com/pages/vul/DSECRG-09-013.html Application: IBM WebSphere Application Server Versions Affected: 7.0 and 6.1 Vendor URL: http://www.ibm.com/websphere/ Bug: Multiple XSS Vulnerabilities Exploits...

Design/Logic Flaw

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

CVE-2008-6531

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

CVE-2008-6531

Affected software: Atlassian Jira (

CVE-2008-6531: Improper Control of Generation of Code

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...

Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC

No description provided by source. Try this: chromehtml:"%20--renderer-path="calc"%20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution...

Google Chrome code execution

chromehtml: URI parameter injection...

Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC

Try this: chromehtml:"20--renderer-path="calc"20--no-sandbox Disabling sandbox does matter : Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: htmlheadtitleChrome URI Handler Remote Command Execution PoC/title/head body h3This is a test/h3 iframe...

Google Chrome 1.0.154.46 (ChromeHTML://) Parameter Injection PoC

Exploit for unknown platform in category remote exploits ================================================================ Google Chrome 1.0.154.46 ChromeHTML:// Parameter Injection PoC ================================================================ Try this:...

Google Chrome Parameter Injection

click me...

Internet Explorer 'chromeHTML://'命令行参数注入漏洞

BUGTRAQ ID: 32999 Internet Explorer是一款流行的WEB浏览器。 Internet Explorer不正确处理用户输入，远程攻击者可以利用漏洞通过协议处理器注入命令行参数，造成以登录用户上下文执行任意代码。 问题是处理'chromeHTML://'协议存在问题，构建恶意WEB页，诱使用户访问可触发此漏洞。 Microsoft Internet Explorer 8 beta 2 目前没有解决方案提供： http://www.microsoft.com/ie/ !-- Google Chrome Browser ChromeHTML:// remote...

Google Chrome Browser (ChromeHTML://) Remote Parameter Injection

No description provided by source. !-- Google Chrome Browser ChromeHTML:// remote parameter injection POC by Nine:Situations:Group::bellick&strawdog Site: http://retrogod.altervista.org/ tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3 List of command...

Google Chrome Browser (ChromeHTML://) Remote Parameter Injection

Exploit for unknown platform in category remote exploits ================================================================ Google Chrome Browser ChromeHTML:// Remote Parameter Injection ================================================================ 0day.today 2018-03-01...