Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.x - Multiple Vulnerabilities Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Aja...

Ajax Availability Calendar 3.x - Multiple Vulnerabilities

Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Ajax Availability Calendar" , inurl:"/ac-admin/index.php" ===...

Ajax Availability Calendar 3.X.X Multiple Vulnerabilties

Exploit for php platform in category web applications Ajax Availability Calendar 3.X.X Multiple Vulnerabilties ============================================================== .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.ajaxavailabilitycalendar.com/ .:. Dork : intitle:"Aja...

WordPress Search And Share 0.9.3 Cross Site Scripting

Hello list! I want to inform you about vulnerabilities in Search and Share plugin for WordPress. These are Cross-Site Scripting and Full path disclosure vulnerabilities. These XSS holes are in ZeroClipboard.swf, which is used in the plugin. In February I've wrote about Cross-Site Scripting...

ColdFusion 9-10 - Credential Disclosure

ColdFusion 9-10 - Credential Disclosure !/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m"...

ColdFusion 9-10 - Credential Disclosure

!/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m" clear = "\x1b0m" print...

ColdFusion 9 / 10 Remote Root Exploit

ColdFusion version 9 and 10 remote root zero day exploit !/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m"...

ColdFusion 9 / 10 Remote Root

!/usr/bin/env python -- coding: utf-8 -- intro=""" Cold ,''' Fusion || | | \ / | Cold ,''' /-- Fusion | | | | / |. Cold -,,' Fusion Name : ColdSub-Zero.pyFusion v2 Description : CF9-10 Remote Root Zeroday Crew : HTP """ cyan = "\x1b1;36m" red = "\x1b1;31m" clear = "\x1b0m" print...

XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress

Hello 3APA3A! These are Cross-Site Scripting and Full path disclosure vulnerabilities in multiple themes for WordPress with ZeroClipboard.swf. Earlier I've wrote about Cross-Site Scripting vulnerabilities in ZeroClipboard http://seclists.org/fulldisclosure/2013/Feb/103. I wrote that this is very...

Vulnerabilities in multiple themes for WordPress with jPlayer

Hello 3APA3A! I want to inform you about multiple vulnerabilities in multiple themes for WordPress with jPlayer. These are Cross-Site Scripting, Content Spoofing and Full path disclosure vulnerabilities. I've wrote about vulnerabilities in jPlayer earlier...

Multiple vulnerabilities in Colormix theme for WordPress

Hello 3APA3A! Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed holes related to JW Player. In December I'...

[ISecAuditors Security Advisories] Multiple Full Path Disclosure Vulnerabilities in TinyWebGallery <= v1.8.9

============================================= INTERNET SECURITY AUDITORS ALERT 2013-012 - Original release date: March 19th, 2013 - Last revised: April 6th, 2013 - Discovered by: Manuel Garcia Cardenas - Severity: 5/10 CVSS Base Score - CVE-ID: CVE-2013-2631...

Simple Posting System Final LFI/XSS/FPD Vulnerabilities

Simple Posting System suffers from multiple vulnerabilities including LFI/XSS/FPD +-- LFI --+ http://localhost/sps.php?old=../../../../../../../../../../../../../../../../../etc/passwd%00 +-- Persistent XSS --+ Vulnerable Field = "Homepage" Payload syntax: alert'XSS'; +-- FPD --+...

Photocrati Theme - Full Path Disclosure

The photocrati-theme WordPress theme was affected by a Full Path Disclosure security vulnerability...

WordPress Colormix Theme - Multiple Security Vulnerablities

WordPress Colormix theme is prone to multiple security vulnerabilities such as cross-site scripting, path disclosure and multiple content-spoofing vulnerabilities. Solution Update the theme...

WordPress Colormix XSS / Content Spoofing / Path Disclosure

Hello list! Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed holes related to JW Player. In December I've...

WordPress Colormix theme XSS / Full path disclosure Vulnerability

Exploit for php platform in category web applications Last year I've disclosed vulnerabilities in JW Player and in RokBox. Which were fixed by the developers - JW Player developers fixed one hole and promised to fix others later and RokBox fixed all holes but it was questionable how they fixed...

WordPress Theme Colormix - Multiple Vulnerabilities

WordPress Theme Colormix - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/59371/info The Colormix theme for WordPress is prone to multiple security vulnerabilities, including: 1. A cross-site scripting vulnerability 2. A path-disclosure vulnerability 3. Multiple content-spoofi...

Mandriva Linux Security Advisory : dokuwiki (MDVSA-2013:073)

Updated dokuwiki package fixes security vulnerabilities : DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files...

SAP Portal WebDynPro - Path disclosure

Application: SAP NetWeaver JAVA Versions Affected: SAP NetWeaver J2EE Vendor URL: http://www.sap.com Bugs: Information Disclosure Exploits: YES Reported: 20.04.2013 Vendor response: 21.04.2013 Date of Public Advisory: 25.01.2014 Reference: SAP Security Note 1852146 CVSS: AV:N/AC:L/AU:N/C:P/I:N/A:...