Proxmox Mail Gateway 3.1 Cross Site Scripting

I. VULNERABILITY ------------------------- Multiplus XSS in Proxmox Mail Gateway 3.1 II. BACKGROUND ------------------------- Proxmox Mail Gateway helps you protect your business against all email threats like spam, viruses, phishing and trojans at the moment they emerge. The flexible architectur...

Fitnesse远程代码执行漏洞

Bugtraq ID:65921 CVE ID:CVE-2014-1216 FitNesse是一套软件开发协作工具。 Fitnesse Wiki不正确校验已编辑页面语法参数数据，允许远程攻击者利用漏洞提交特殊的请求以应用程序上下文执行任意命令。 0 Fitnesse Wiki v20131110 目前没有详细解决方案提供： http://www.fitnesse.org POST /any page HTTP/1.1 Host: host:port Proxy-Connection: keep-alive Content-Length: 374 Accept:...

IBM Netezza Performance Portal用户验证凭据管理绕过漏洞

CVE ID:CVE-2013-6731 IBM Netezza数据仓库应用设备将存储、处理、数据库和分析融入到一个高性能数据仓库设备中,使大数据高级分析更简单、更迅捷和更易用。 IBM Netezza Performance Portal不正确限制对验证凭据管理的访问，允许攻击者利用漏洞通过特制的HTTP POST请求来更改其他用户的密码。 0 IBM Netezza Performance Portal 2.0 IBM Netezza Performance Portal 2.0.0.1 IBM Netezza Performance Portal 2.0.0.2 厂商补丁： IBM...

Ultra Mini HTTPd 1.21 - POST Remote Stack Buffer Overflow (1)

Ultra Mini HTTPd 1.21 - POST Remote Stack Buffer Overflow 1 Exploit Title: Ultra Mini HTTPD stack buffer overflow POST request Date: 16 Feb 2014 Exploit Author: Sumit Vendor Homepage: http://www.picolix.jp/ Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html Version: 1.21 Tested o...

Ultra Mini HTTPd 1.21 - 'POST' Remote Stack Buffer Overflow (1)

Exploit Title: Ultra Mini HTTPD stack buffer overflow POST request Date: 16 Feb 2014 Exploit Author: Sumit Vendor Homepage: http://www.picolix.jp/ Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html Version: 1.21 Tested on: Windows XP Professional SP3 Description: A buffer overflo...

Discuz! X upgrade/conversion program GETSHELL vulnerability analysis-vulnerability warning-the black bar safety net

0x01 vulnerability analysis Vulnerability root cause in the code comment appears in the wrap, resulting in code execution, the process is as follows: 0x0101 first, from the index. php the 3 row 0 with into. ! enter image description here 0x0102 doconfiginc. php 3, line 7, with the into this...

CVE-2013-6492

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

Authentication flaw

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

CVE-2013-6492

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

PT-2025-31542 · Linksys · Linksys Wrt120N

Name of the Vulnerable Software and Affected Versions: Linksys WRT120N wireless routers affected versions not specified Description: A stack-based buffer overflow exists in the tmUnblock.cgi endpoint of Linksys WRT120N wireless routers. The issue occurs when processing the TM Block URL parameter...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answerid...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answeri...

Geeklog Calendar Plugin Cross Site Scripting Vulnerability

Geeklog is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting (XSS) in Ilch CMS

High-Tech Bridge Security Research Lab discovered vulnerability in Ilch CMS, which can be exploited to perform Cross-Site Scripting XSS attacks against users and administrators of vulnerable application. 1 Cross-Site Scripting XSS in Ilch CMS: CVE-2014-1944 The vulnerability exists due to...

phpBB 3.0.8 - Remote Denial of Service

phpBB 3.0.8 - Remote Denial of Service source: https://www.securityfocus.com/bid/65481/info phpBB is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Phpbb Forum Denial of Service...

Phire CMS 1.1.2 - Multiple XSS Vulnerabilities

Latest Phire CMS suffers on multiple cross site scripting vulnerabilities because of poor variables filtration. Title: Phire CMS 1.1.2 - Multiple XSS Vendor: phirecms.org - en.wikipedia.org/wiki/PhireCMS Version: 1.1.2 Latest ATM Demo: demo.phirecms.org Date: 01.25.2014 Contact:...

Easy POS System SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You might use ‘sqlmap -l’ to load it though. PoC: POST /login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0...

godontologico 5 SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests as indicated on the output. You might use sqlmap -l to load it though. Admin hashes under Table ‘funcionarios' on column ‘senha'. PoC: POST /gco/wallpapers/indexajax.php HTTP/1.1...

Easy POS System SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Easy POS System - 'login.php' SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...