Ajax Short URL Script - Authentication Bypass

Ajax Short URL Script - Authentication Bypass - Discovered By: Cicklow - Date: 03.08.2009 Exploit: username: realadminname ' or ' 1=1 password: cicklow note: generally admin name: admin or any user Buy Script: http://junglescripts.com/shorturls.php Admin login Demo: http://href.in/x/login...

VLC Media Player < 1.0.1 real_get_rdt_chunk() Function Overflow

The version of VLC media player installed on the remote host is earlier than 1.0.1. Such versions contain an integer underflow involving the integer 'size' in the 'realgetrdtchunkheader' function that can be triggered when reading Real Data Transport RDT chunk headers. This 'size' variable is use...

intval()is used improperly cause a security vulnerability analysis-vulnerability warning-the black bar safety net

author: xy780sec.com from: A description of the classification intval function has two characteristics:"until the encounter on the numbers or the positive and negative symbols before starting to do the conversion, and then encounter non-numeric or string at the end\0end of conversion",in certain...

The Movie Player / VLC Media Player integer overflow

Integer overflow on Real stream parsing...

[Full-disclosure] [DZC-2009-001] The Movie Player and VLC Media Player Real Data Transport parsing integer underflow.

Advisory: The Movie Player and VLC Media Player Real Data Transport parsing integer underflow. Affected products: The Movie player svn r29438 1 VLC media player = 1.0.0 2 Possible others applications that use the xine lib code 3. Discovred by: tixxDZ tixxdz at gmail dot com DZCORE Labs, Algeria...

Real Helix DNA RTSP and SETUP Request Handler Vulnerabilities

Exploit for multiple platform in category dos / poc ============================================================= Real Helix DNA RTSP and SETUP Request Handler Vulnerabilities ============================================================= -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security...

Real Helix DNA RTSP and SETUP request handler vulnerabilities

Core Security - CoreLabsReal Helix DNA RTSP and SETUP request handler vulnerabilities 1. Advisory Information Title: Real Helix DNA RTSP and SETUP request handler vulnerabilities Advisory ID: CORE-2009-0227 Advisory URL: http://www.coresecurity.com/content/real-helix-dna Date published: 2009-07-1...

Core Security Technologies Advisory 2009.0227

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Real Helix DNA RTSP and SETUP request handler vulnerabilities 1. Advisory Information Title: Real Helix DNA RTSP and SETUP request handler vulnerabilities Advisory ID...

Month Of Twitter Bugs - TweetGrid XSS

Sunday, July 12, 2009 MoTB 12: Reflected XSS in TweetGrid What is TweetGrid "TweetGrid is a powerful Twitter Search Dashboard that allows you to search for up to 9 different topics, events, converstations, hashtags, phrases, people, groups, etc in real-time. As new tweets are created, they are...

Joomla Real Estate Manager 1.0 Remote File Inclusion

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-= Joomla comrealestatemanager 1.0 Remote File Include Download: http://ordasoft.com/Download-document/4-Real-Estate-Manager-Basic.html =-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-= Found: xoron contact:...

CVE-2008-6818

Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Code injection

Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-6818

The CVE-2008-6818 entry concerns Mole Group Real Estate Script (version 1.1 and earlier) where passwords are stored in cleartext. The root cause is insecure credential storage, enabling context-dependent attackers to obtain sensitive information. The connected documents confirm the existence of t...

Impact Software AdPeeps 8.5d1 - Cross-Site Scripting HTML Injection

Impact Software AdPeeps 8.5d1 - Cross-Site Scripting HTML Injection AdPeeps Ad Rotator - XSS and HTML Injection Vulnerabilities Version Affected: 8.5d1 3-18-09 newest Info: Ad Peeps is a banner rotator and text ad rotator - all in one that allows you to track, sell and manage banner ads,...

Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

saveFeed $rssversionname, $cacheFile ; ... it calls saveFeed function in an insecure way, arguments are built on $REQUESTversion var and may contain directory traversal sequences... now look at saveFeed function in /rss/feedcreator.class.php ... function saveFeed$filename="", $displayContents=tru...

CVE-2008-6798

Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL commands via 1 the us parameter aka the Username field or 2 the ps parameter aka the Password field...

Sql injection

Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL commands via 1 the us parameter aka the Username field or 2 the ps parameter aka the Password field...

CVE-2008-6798

Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL commands via 1 the us parameter aka the Username field or 2 the ps parameter aka the Password field...

CVE-2008-6798

The CVE-2008-6798 entry describes multiple SQL injection vulnerabilities in login.php of Pre Projects Pre Real Estate Listings. The vulnerability allows remote attackers to execute arbitrary SQL commands via the us (Username) or ps (Password) parameters, enabling potential unauthorized data acces...

CVE-2008-6796

SQL injection vulnerability in manager/login.php in Pre Projects Pre Real Estate Listings allows remote attackers to execute arbitrary SQL commands via the username1 parameter aka the Admin field or Username field...