Aardvark Topsite XSS vulnerability

Hi, I found XSS on Aardvark Topsites PHP system. Dork: "Powered by Aardvark Topsites" "SQL Queries" XSS: sitepath/index.php?a=search&q=2220onmouseover3dalertString.fromCharCode88,83,8320par3d22 Can use POST to effect the "email", "title", "u" and "url" parameters either on the same way. Tested...

SQL Injection in 4site CMS

Vulnerability ID: HTB22639 Reference: http://www.htbridge.ch/advisory/sqlinjectionin4sitecms.html Product: 4site CMS Vendor: Method Lab http://www.4site.ru/ Vulnerable Version: 2.6 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...

IBM Tivoli Provisioning Manager for OS Deployment TCP to ODBC Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL queries on vulnerable installations of Tivoli Provisioning Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TCP to ODBC gateway component which listens by default on TCP...

CVE-2010-0218

ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ability of Recursion Desired RD queries to access the cache, which allows remote attackers to obtain potentially sensitive information via a DNS query...

Joomla! Component JE Guestbook 1.0 - Multiple Vulnerabilities

JE Guestbook 1.0 Joomla Component Multiple Remote Vulnerabilities Name JE Guestbook Vendor http://www.joomlaextensions.co.in Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-09-30 X. INDEX I. ABO...

E-Xoopport - Samsara SQL Injection Vulnerability

E-Xoopport - Samsara is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SQL injection vulnerability in Entrans

Vulnerability ID: HTB22608 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinentrans1.html Product: Entrans Vendor: Khader Abbeb N http://sourceforge.net/projects/entrans/ Vulnerable Version: 0.3.2 and Probably Prior Versions Vendor Notification: 13 September 2010 Vulnerabilit...

SQL injection vulnerability in e107

Vulnerability ID: HTB22603 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1071.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 03 September 2010 Vulnerability Type: SQL Injectio...

BugTracker.NET 'search.aspx' SQL Injection Vulnerability

The host is running BugTracker.NET and is prone to SQL injection vulnerability. OpenVAS Vulnerability Test $Id: gbbugtrackersqlinjvuln.nasl 5263 2017-02-10 13:45:51Z teissa $ BugTracker.NET 'search.aspx' SQL Injection Vulnerability Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone Networks...

Design/Logic Flaw

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIGCIFSDFSUPCALL is enabled, relies on a user's keyring for the dnsresolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform...

CVE-2010-2524

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIGCIFSDFSUPCALL is enabled, relies on a user's keyring for the dnsresolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform...

Multiple Cisco Products Vulnerable to DNS Cache Poisoning Attacks

Multiple Cisco products are vulnerable to DNS cache poisoning attacks due to their use of insufficiently randomized DNS transaction IDs and UDP source ports in the DNS queries that they produce, which may allow an attacker to more easily forge DNS answers that can poison DNS caches. To exploit th...

MySQL Community Server 5.1 < 5.1.49 Multiple Denial of Service Vulnerabilities

Binary data 801140.prm...

CVE-2010-2545

Multiple cross-site scripting XSS vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing HPC Solution and other products, allow remote attackers to inject arbitrary web script or HTML via 1 the name element in an XML template to templatesimport.php; and allow remote...

Joomla! Component Teams - Multiple Blind SQL Injections

Joomla! Component Teams - Multiple Blind SQL Injections Teams 110281008091711 Joomla Component Multiple Blind SQL Injection Vulnerabilities Name Teams Vendor http://www.joomlamo.com Versions Affected 110281008091711 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net...

Joomla! Component Teams - Multiple Blind SQL Injections

Teams 110281008091711 Joomla Component Multiple Blind SQL Injection Vulnerabilities Name Teams Vendor http://www.joomlamo.com Versions Affected 110281008091711 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-08-10 X...

Joomla Spielothek 1.6.9 Blind SQL Injection

Spielothek 1.6.9 Joomla Component Multiple Blind SQL Injection Name Spielothek Vendor http://www.spielban.de Versions Affected 1.6.9 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-31 X. INDEX I. ABOUT THE...

Huru Helpdesk Component for Joomla! 'cid[0]' Parameter SQLi

The version of the Huru Helpdesk component for Joomla! running on the remote host is affected by a SQL injection vulnerability due to improper sanitization of user-supplied input to the 'cid0' parameter before using it to construct database queries. Regardless of the PHP 'magicquotesgpc' setting,...

PBBooking 1.0.4_3 Joomla Component Multiple Blind SQL Injection

PBBooking 1.0.43 Joomla Component Multiple Blind SQL Injection Name PBBooking Vendor http://sourceforge.net/projects/pbbooking/ Versions Affected 1.0.43 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-29 X. INDEX ...

Joomla! Component com_photomapgallery 1.6.0 - Multiple Blind SQL Injections

Joomla! Component comphotomapgallery 1.6.0 - Multiple Blind SQL Injections PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection Name PhotoMap Gallery Vendor http://extensions.joomla.org/extensions/photos-a-images/photo-gallery/10658 Versions Affected 1.6.0 Author Salvatore Fresta...