Fedora 22 : glpi-0.85.2-2.fc22 (2015-4690)

Fix privilege escalation via user creation with a crafted POST request Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Joomla! Component com_gallery_wd - SQL Injection

Exploit Title: Joomla Gallery WD - SQL Injection Vulnerability Google Dork: inurl:option=comgallerywd Date: 29.03.2015 Exploit Author: CrashBandicot @DosPerl Vendor HomePage: http://web-dorado.com/ Source Component :...

CVE-2014-5427

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

CVE-2014-5427

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

Project avatar resource vulnerable to XSRF

The project avatar resource accepts content type of MULTIPARTFORMDATA so a malicious attacker could use javascript to submit a form from a foreign host to a stash server and trick the user into changing the project avatar in Stash. cc David Black Atlassian - is there any reason why panopticon fou...

Mastery oa at the secondary injection vulnerability-vulnerability warning-the black bar safety net

Brief description: Paralysis of the software Detailed description: ! QQ 图片 20141215110029.jpg Add the attention of the people, many functions rely on the data code area POST http://121.40.134.14/general/personinfo/concernuser/update.php HTTP/1.1 Host: 121.40.134.14 Connection: keep-alive...

某信息发布系统SQL注入(demo复现)

简要描述： 某信息发布系统SQL注入demo复现 详细说明： 某信息发布系统SQL注入demo复现 漏洞证明： 注入在这个地方： 抓包看看： POST /index.php HTTP/1.1 Host: pmbdemo.youyax.com Proxy-Connection: keep-alive Content-Length: 21 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin:...

Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability

A vulnerability in Cisco Unified Web Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to a lack of input sanitization of the Cisco Unified Web...

CVE-2015-0655

Cross-site scripting XSS vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184...

Cross site scripting

Cross-site scripting XSS vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184...

CVE-2015-0655

CVE-2015-0655 affects Cisco Unified Web and E‑Mail Interaction Manager (Unified Web Interaction Manager). The vulnerability is an XSS due to lack of input sanitization, exploitable by an unauthenticated, remote attacker who entices a user to submit a crafted POST request to the web interface. Imp...

CVE-2015-0655

Cross-site scripting XSS vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184...

Radexscript CMS 2.2.0 - SQL Injection vulnerability

Vulnerability title: Radexscript CMS 2.2.0 - SQL Injection vulnerability Vendor: http://redaxscript.com/ Product: Radexscript CMS Software link: http://redaxscript.com/download/releases Affected version: Redaxscript 2.2.0 Fixed version: Redaxscript 2.3.0 CVE ID: CVE-2015-1518 Author: Pham Kien...

Cisco TelePresence Management Suite XML External Entity Injection Vulnerability

Cisco TelePresence is a telepresence conferencing solution developed by Cisco. An external entity injection vulnerability exists in Cisco TelePresence Management Suite XML, which allows attackers to conduct denial-of-service attacks against the service by submitting a special POST request due to ...

Piwigo 2.7.3 Cross Site Scripting / SQL Injection Vulnerabilities

CMS Piwigo versions 2.7.3 and below suffer from cross site scripting and remote SQL injection vulnerabilities. Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo = v. 2.7.3 Author: Steffen Rösemann Affected Software: CMS Piwigo = v. 2.7.3 Release date: 9th January 2015 Vendor URL:...

Slack: Team admin can change unauthorized team setting (allow_message_deletion)

Team admin can escalate his privileges and change 'allowmessagedeletion' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin. 2. Send the below request using his cookie & token and notice that it changes 'allowmessagedeletion' team setting to true...

Cock wire from scratch-micro-shoot APP vulnerability-vulnerability warning-the black bar safety net

Micro-shot, is the mobile Internet the most popular mobile video social APP, has a unique whitening Skin Beauty and other video effects in iPhone and Android Phones the App Store social category and the photography category of the APP list are among the best in Beijing grasshopper online Technolo...

ArticleFR CMS 3.0.5 - SQL Injection

Exploit Title: SQL injection vulnerability in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link: https://github.com/articlefr/articleFR Version: version 3.0.5...

vBulletin MicroCART 1.1.4 - Arbitrary File(s) Deletion, SQL Injection & XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion, SQL Injection & XSS Date: January 8, 2015 Exploit Author: Technidev https://technidev.com Vendor Homepage: https://vbulletin.com Software Link:...

vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion SQL Injection Cross-Site Scripting

vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion SQL Injection Cross-Site Scripting Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion, SQL Injection & XSS Date: January 8, 2015 Exploit Author: Technidev https://technidev.com Vendor Homepage: https://vbulletin.com Software...