IBM Security Website Cross Site Scripting

Exploit Title: IBM Security WebSite Cross-Site Scripting Google Dork: N/A Date: 2016/2/5 Exploit Author: RootByte Vendor Homepage: www.ibm.com/security/ Software Link: N/A Version: N/A Tested on: Windows 10 / FireFox 44.0 CVE : N/A about Wikipedia: International Business Machines Corporation...

COMODO Cross Site Scripting

Exploit Title: COMODO Subdomain XSS Vulnerability Google Dork: N/A Date: 2016/2/3 Exploit Author: RootByte Vendor Homepage: http://personalfirewall.comodo.com/ Software Link: N/A Version: N/A Tested on: Windows 10 / FireFox 44.0 CVE : N/A about Wikipedia: COMODO is a privately held group of...

UliCMS v9.8.1 - SQL Injection

UliCMS v9.8.1 - SQL Injection ============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I...

UliCMS v9.8.1 - SQL Injection

============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

Avira Cross Site Scripting

Exploit Title: AVIRA Subdomain XSS Vulnerability Google Dork: N/A Date: 2016/1/29 Exploit Author: RootByte Vendor Homepage: http://translate.avira.com Software Link: N/A Version: N/A Tested on: Windows 10 / FireFox CVE : N/A Vulnerable Location: http://translate.avira.com/accounts/login/ Variable...

Ubiquiti Inc.: account.ubnt.com CSRF

Good Evening Sir, I want to inform you that i have successfully discovered a problem on the API django Restfull API you used to manage the security of https://account.ubnt.com The vulnerability type : CSRF Vulnerability description : An attacker create a web page with the code attached to this...

SAP Netwaver - XML External Entity Injection

Title: SAP Netwaver - XML External Entity Injection Author: Lukasz Miedzinski GPG: Public key provided in attachment Date: 29/10/2014 CVE: CVE-2015-7241 Affected software : =================== SAP Netwear : 7.01 Vendor advisories only for customers: =================== External ID : 851975 2014...

PHP-Fusion 7.02.07 Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

PHP-Fusion 7.02.07 - Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...

SAP NetWeaver 7.01 - XML External Entity Injection

SAP NetWeaver 7.01 - XML External Entity Injection Title: SAP Netwaver - XML External Entity Injection Author: Lukasz Miedzinski GPG: Public key provided in attachment Date: 29/10/2014 CVE: CVE-2015-7241 Affected software : =================== SAP Netwear : XML Content and Actions - Import sectio...

KMPlayer 3.9.1.136 Buffer Overflow

!/usr/bin/python KMPlayer 3.9.1.136 Capture Unicode Buffer Overflow ASLR Bypass Author: Naser Farhadi Date: 21 June 2015 Version: 3.9.1.136 Tested on: Windows 7 SP1 32 bit Usage: chmod +x KMPlayer.py python KMPlayer.py Alt+c | Video Capture | Alt+a | Audio Capture paste content of KMPlayer.txt in...

Wireless N ADSL 2/2+ Modem Router - DT5130 - Xss / URL Redirect / Command Injection

Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...

Technicolor DT5130 V2.05.C29GV - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...

Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities

Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...

WebsiteBaker 2.8.3 Multiple Vulnerabilities

WebsiteBaker versions 2.8.3 and below suffers from cross site scripting, HTTP response splitting, and remote SQL injection vulnerabilities. I. VULNERABILITY ------------------------- Multiple Vulnerabilities in WebsiteBaker 2.8.3 II. BACKGROUND ------------------------- WebsiteBaker helps you to...

Zoph 0.9.1 Cross Site Scripting / SQL Injection Vulnerabilities

Zoph versions 0.9.1 and below suffer from cross site scripting and remote SQL injection vulnerabilities. I. VULNERABILITY ------------------------- Multiple Vulnerabilities in Zoph alert1 /zoph/php/editphotos.php?albumid=2&crumb=3"alert1 V. BUSINESS IMPACT ------------------------- Public...

XOOPS 2.5.6 blind SQL Injection Vulnerability

XOOPS versions 2.5.6 and below suffer from a remote blind SQL injection vulnerability. I. VULNERABILITY ------------------------- Blind SQL Injection in XOOPS 5.0.11 AND time-based blind comment' injectable INFO POST parameter 'selgroups' is 'OR boolean-based blind - WHERE or HAVING clause MySQL...

Piwigo <= v2. 6. 0 - Blind SQL Injection-vulnerability warning-the black bar safety net

Piwigo = v2. 6. 0 - Blind SQL Injection -------------------------------------------------------------------------------- From: Manuel Garcia Cardenas Date: Wed, 1 2 Nov 2 0 1 4 0 9:5 6:2 2 +0 1 0 0 --------------------------------------------------------------------------------...

Piwigo 2.6.0 - picture.php?rate SQL Injection

Piwigo 2.6.0 - picture.php?rate SQL Injection ============================================= MGC ALERT 2014-001 - Original release date: January 12, 2014 - Last revised: November 12, 2014 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...

Piwigo 2.6.0 - 'picture.php?rate' SQL Injection

============================================= MGC ALERT 2014-001 - Original release date: January 12, 2014 - Last revised: November 12, 2014 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...