Xataface WebAuction / Librarian DB XSS / LFI / SQL Injection

Title : Xataface WebAuction and Xataface Librarian DB Multiple Vulnerabilities. Author : Antu Sanadi SecPod Technologies www.secpod.com Vendor : http://xataface.com/ Advisory : http://secpod.org/blog/?p=350 http://secpod.org/advisories/SECPODXatafaceWebauctionMultVuln.txt Software : Xataface...

Xataface WebAuction and Xataface Librarian DB Multiple Vulnerabilities

Xataface WebAuction/Librarian DB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Evidence of Infected SCADA Systems Washes Up in Support Forums

While security experts and lawmakers debate the seriousness of cyber threats to critical infrastructure, one security researcher says that evidence that viruses and spyware already have access to industrial control systems is hiding in plain sight: on Web based user support forums. Close to a doz...

mDNS Client Queries

Binary data 6014.prm...

WordPress WP Forum plugin <= 1.7.8 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress WP Forum plugin getrow"SELECT text, authorid, date FROM $tableposts WHERE id = $id"; $u = new WPuser$text-authorid; echo htmlentities"QUOTE $u-nickname @ ".dategetoption'forumdateformat', strtotime$text-date."\n...

Design/Logic Flaw

The DNS server in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 does not properly handle NAPTR queries that trigger recursive processing, which allows remote attackers to execute arbitrary code via a crafted query, aka "DNS NAPTR Query Vulnerability."...

CVE-2011-1966

The CVE-2011-1966 issue affects Microsoft Windows DNS Server on Windows Server 2008 SP2, R2, and R2 SP1, where the DNS server mishandles NAPTR queries that trigger recursive processing. The root cause is a memory corruption vulnerability exploitable via specially crafted NAPTR queries, which can ...

CVE-2011-1966: Improper Input Validation

The DNS server in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 does not properly handle NAPTR queries that trigger recursive processing, which allows remote attackers to execute arbitrary code via a crafted query, aka "DNS NAPTR Query Vulnerability."...

PT-2011-3508

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2008 R2 SP1 Description The issue arises from the DNS server's improper handling of NAPTR queries that trigger recursive processing. This allows remote...

CVE-2011-2979

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

CVE-2011-2979

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

CVE-2011-2979: Undefined Security Weakness

Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the existence of private group names via a custom search. NOTE: this vulnerability exists because of a CVE-2010-2756...

AlphaRegistration Component for Joomla! 'email' Parameter SQLi

The version of the AlphaRegistration Component for Joomla! running on the remote host is affected by a SQL injection vulnerability in assets/scripts/checkemail.php due to improper sanitization of user-supplied input to the 'email' parameter before using it to construct database queries. Provided...

Symantec Web Gateway login.php Blind SQL Injection (SYM11-001)

According to its self-reported version number, the version of Symantec Web Gateway running on the remote host has a SQL injection vulnerability. Input to the 'USERNAME' parameter of the 'login.php' script is not properly sanitized. A remote, unauthenticated attacker could exploit this to manipula...

phpDealerLocator SQL Injection

Exploit Title: phpDealerLocator - Multiple SQL Injection vulnerabilities Date: 7/3/2011 Author: Robert Cooper adminatwebsiteauditing.org Software Link: phpdealerlocator.yourphppro.com Tested on: Linux/Windows 7 Vulnerable Parameters: record.php?DealerID= recordcountry.php?DealerID=...

Joomla Minitek FAQ Book 'id' Parameter SQL Injection Vulnerability

This host is running Joomla Minitek FAQ Book component and is prone to SQL injection vulnerability. OpenVAS Vulnerability Test $Id: gbjoomlaminiteksqlinjvuln.nasl 7573 2017-10-26 09:18:50Z cfischer $ Joomla Minitek FAQ Book 'id' Parameter SQL Injection Vulnerability Authors: Madhuri D Copyright:...

INFOPUBLICA Solutions SQL-i Vulnerability

Exploit for php platform in category web applications ========================================================================= INFOPUBLICA Solutions SQL-i Vulnerability ==========================================================================...

Fedora Update for phpMyAdmin FEDORA-2011-7702

Check for the Version of phpMyAdmin OpenVAS Vulnerability Test Fedora Update for phpMyAdmin FEDORA-2011-7702 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

WordPress Star Rating SQL Injection

Wordpress "wp star rating" plugin SQL injection http://yourwordpress/wp-content/plugins/gd-star-rating/ajax.php?wpnonce=&votetype=cache&votedomain=a&votes=asr.1.xxx.1.2.5+limit+0+union+select+1,0x535242,1,1,co...

Ushahidi 2.0.1 SQL Injection

Ushahidi 2.0.1 range param SQL Injection Vulnerability post-auth Vendor: Ushahidi, Inc. Product web page: http://www.ushahidi.com Affected version: 2.0.1 Tunis Summary: The Ushahidi Platform is a platform for information collection, visualization and interactive mapping. Desc: Input passed via th...