SEC Consult SA-20140430-0 :: SQL injection and persistent XSS in the Typo3 3rd party extension si_bibtex

SEC Consult Vulnerability Lab Security Advisory 20140430-0 ======================================================================= title: SQL injection and persistent XSS product: Typo3 3rd party extension sibibtex vulnerable version: sibibtex 0.2.3 fixed version: - impact: critical homepage:...

HP Laser Jet - JavaScript Persistent XSS via PJL Directory Traversal

Exploit for hardware platform in category web applications !/usr/bin/perl use strict; use warnings; use IO::Socket::INET; my $host = $ARGV0; Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL Google Dork: n/a Date: 4/22/14 Exploit Author: @0x00string Vendor Homepage:...

Juniper Networks Junos OS J-Web Persistent Cross Site Scripting Vulnerability

Persistent XSS Vulnerability in J-Web SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if description...

Mail.ru: Persistent XSS in afisha.mail.ru

Adding a comment to article, this makes javascript execution possible. POST: http://afisha.mail.ru/ext/addcomment/ Post Content alias=article&id=42797&pid=&count=20&commentbody=%5Btesting%5D+%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&ok=%D0%94%D0%BE%D0%B1%D0%B0%D0%B2%D0%B8%D1%82%D1%8C also the...

IRCCloud: Dangerous Persistent xss

If a person is an op in a channel, it is possible to make all the users inside the irc channel execute javascript code. Steps to repoduce: 1.Go to a random channel where you are op. 2.Enter the following command: /ban alert2 3.The script will execute an alert box containing 2 in all the browsers ...

Khan Academy: Persistent class XSS [the fuck]

Hi, I created a class called : " and it actually worked 0.0. It worked here for me : https://www.khanacademy.org/coach/reports/grid?force=1 Best regards, Olivier Beg...

Vulnerability in World Largest Video Site Turned Million of Visitors into DDoS Zombies

An application layer or 'layer 7' distributed denial of service DDoS attacks is one of the most complicated web attack that disguised to look like legitimate traffic but targets specific areas of a website, making it even more difficult to detect and mitigate. Just Yesterday Cloud-based security...

Kyocera FS5250 Cross Site Scripting

Found the below on a printer a couple of years ago, sent to Kyocera but never heard anything back... Changing the 'Ready' message on a printer is quite a well known prank And much fun was had with this yesterday! but also an interesting avenue for injecting XSS, as the Kyocera printer management...

Phabricator: Persistent XSS: Editor link

The editor link used for external applications allows scheme other than http: or https:. Although the phutiltag function checks whether the scheme is javascript: to prevent XSS attacks see GitHub, it is straightforward to bypass this check by adding a whitespace character in between javascript an...

Ubee EVW3200 Cross Site Scripting

Exploit Title: Ubee EVW3200 - Multiple Persistent Cross Site Scripting Google Dork: N/A Date: 02-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.ubeeinteractive.com/ Software Link: http://www.ubeeinteractive.com/products/cable?fieldproductcatetorytid=20 Version: All Tested...

Ilch CMS 2.0 - Persistent XSS Vulnerability

Ilch CMS version 2.0 suffers from a cross site scripting vulnerability. Product: Ilch CMS Vendor: http://ilch.de Vulnerable Versions: 2.0 and probably prior Tested Version: 2.0 Advisory Publication: February 12, 2014 without technical details Vendor Notification: February 12, 2014 Public...

SpagoBI 4.0 - Persistent XSS Vulnerability

Exploit for php platform in category web applications 1. Vulnerability Information CVE reference: CVE-2013-6232 CVSS v2 Base Score: 4 CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N Component/s: SpagoBI Class: Input Manipulation 2. Introduction SpagoBI1 is an Open Source Business Intelligence suite,...

EPESI CRM 1.5.5 Cross Site Scripting

============================================================== Title ...| EPESI CRM vulnerable to persistent XSS Version .| epesi-1.5.5-20140113.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://epe.si/download ==============================================================...

CMS Made Simple contains multiple cross-site scripting vulnerabilities

Overview CMS Made Simple contains multiple cross-site scripting vulnerabilities Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-0334The files: cmsmadesimple/admin/addgroup.php on line 107 contains a post-authentication reflected XS...

doorGets 6.0 Cross Site Scripting

============================================================== Title ...| doorGets 6.0 Multiple vulnerabilities Version .| doorGets 6.0 Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://sourceforge.net ==============================================================...

Moodle 2.6.1 Cross Site Scripting

============================================================== Title ...| Moodle 2.6.1 Version .| Feb 27 2014 moodle-latest-26.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://download.moodle.org ============================================================== + From admin user:...

PHP Calendar 2.0.1 XSS / Information Disclosure

============================================================== Title ...| PHP Calendar Multiple vulnerabilities Version .| php-calendar-2.0.1.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://sourceforge.net ============================================================== + As gue...

Open-School Community Edition 2.2 Cross Site Scripting

============================================================== Title ...| Open-School Community Edition 2.2 Version .| osv2.2-CE.zip Date ....| 23.02.2014 Found ...| HauntIT Blog Home ....| http://sourceforge.net ============================================================== + From admin user:...

WordPress Media File Renamer 1.7.0 Cross Site Scripting

Title: Persistent XSS in Media File Renamer V1.7.0 wordpress plugin Date: 1/31/2014 Author: Larry W. Cashdollar, @larry0 Vendor: Notified 2/4/2014 CVE: 2014-2040 Download: http://www.meow.fr/media-file-renamer/ Vulnerability: The following functions do not sanitize input before being echoed out: ...

ILIAS 4.4.1 Cross Site Scripting / Shell Upload

============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de ============================================================== First from admin user logged...