WordPress e-Commerce 3.8.5 Cross Site Scripting

Vulnerability ID: HTB23031 Reference: http://www.htbridge.ch/advisory/xssinwpecommerce.html Product: WP e-Commerce Vendor: Instinct Entertainment http://getshopped.org/ Vulnerable Version: 3.8.5 and probably prior Tested on: 3.8.5 Vendor Notification: 13 July 2011 Vulnerability Type: XSS Cross Si...

HESK 2.2 Cross Site Scripting

Vulnerability ID: HTB23030 Reference: http://www.htbridge.ch/advisory/multiplexssinhesk.html Product: HESK Vendor: Klemen Stirn http://www.hesk.com/ Vulnerable Version: 2.2 and probably prior Tested on: 2.2 Vendor Notification: 06 July 2011 Vulnerability Type: XSS Cross Site Scripting Risk level:...

Многичесленные уязвимости в Register Plus для WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною многочисленных Cross-Site Scripting уязвимостях в плагине Register Plus для WordPress. XSS persistent WASC-08: При включенных опциях Enable Invitation Codes и Enable Invitation Tracking Dashboard Widget и коде scriptalertdocument.cookie/script в...

Digital Scribe 1.5 Cross Site Scripting

25: 26: 27: Title:" SIZE=4 Mr., Mrs., etc 28: 29: Last Name:" 30: Password: 31: 32: Password Again: 33: 34: E-Mail:INPUT TYPE=TEXT NAME=e...

Miniblog 1.0.0 Cross Site Request Forgery / Cross Site Scripting

Vulnerability ID: HTB23008 Reference: http://www.htbridge.ch/advisory/multiplexssinminiblog.html Product: miniblog Vendor: spyka Web Group http://www.spyka.net Vulnerable Version: 1.0.0 and probably prior Tested on: 1.0.0 Vendor Notification: 25 May 2011 Vulnerability Type: XSS Cross Site Scripti...

Cross-site Scripting (XSS) Vulnerability in FanUpdate

High-Tech Bridge SA Security Research Lab has discovered vulnerability in FanUpdate which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in FanUpdate The vulnerability exists due to input sanitation error in the "pageTitle" parameter in...

Asterisk 1.8.4 SIP Username Enumeration

Asterisk, sip response permit username identification through use REGISTER Author: francesco.tornieri "At" verona-wireless.net Summary: Sip responses permit user identification Release Date: 25/05/2011 Criticality level: Low Impact: Information leak Software: Asterisk 1.8.4 I try it to an...

Microsoft Patches Hotmail Security Vulnerability !

Microsoft recently patched a Hotmail security flaw that enabled attackers to access a user's e-mails and contacts. "The vulnerability was actively being exploited using emails that contained malicious scripts, Trend Micro researcher Karl Dominguez said Monday," writesThe Register's Dan Goodin...

phpScheduleIt 1.2.12 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/47951/info phpScheduleIt is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in t...

HTB22974: Multiple XSS in Calendarix

Vulnerability ID: HTB22974 Reference: http://www.htbridge.ch/advisory/multiplexssincalendarix.html Product: Calendarix Vendor: http://www.calendarix.com http://www.calendarix.com Vulnerable Version: 0.8.20080808 Vendor Notification: 26 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

CVE-2010-2789

PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via unspecified vectors...

TextAds 2.08 Script Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Name: TextAds 2.08 Script Cross Site Scripting Vulnerability Vendor: http://idevspot.com/TextAds2.php Price: $49.95 Date: 2011-04-14 Author: Ashiyane Digital Security Team Thanks to: 1337day.com,Securityreason.com,packetstormsecurity.com,...

TextAds 2.08 Script - Cross-Site Scripting

TextAds 2.08 Script - Cross-Site Scripting =========================================================================== TextAds 2.08 Script Cross Site Scripting Vulnerability =========================================================================== Name: TextAds 2.08 Script Cross Site Scripting...

kernel security update

CentOS Errata and Security Advisory CESA-2011:0429 Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scorin...

kernel: s390 task_show_regs infoleak

The taskshowregs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Pligg CMS 1.1.3 Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit title: Pligg CMS file existence exploration/shared hosting privilege escalation H.ackAck.net Found by: Jelmer de Hen 15/03/2011 I released some Pligg exploits: http://h.ackack.net/the-pligg-cms-0dayset-1.html 22/03/2011 a patch became...

N'CMS 1.1E Pre-Auth Local File Inclusion Code Execution

!/usr/bin/python INFORMATION Exploit Title: NCMS 1.1E Pre-Auth Local File Inclusion Remote Code Exploit Date: 11/3/2011 Software link: http://bit.ly/eJAyw5 Tested on: Linux bt Version: 1.1E PHP.ini Settings: gpcmagicquotes = Off Note: The web application was lucky to not be exploited by session...

N_CMS 1.1E - Local File Inclusion / Remote Code

!/usr/bin/python INFORMATION Exploit Title: NCMS 1.1E Pre-Auth Local File Inclusion Remote Code Exploit Date: 11/3/2011 Software link: http://bit.ly/eJAyw5 Tested on: Linux bt Version: 1.1E PHP.ini Settings: gpcmagicquotes = Off Note: The web application was lucky to not be exploited by session...

Design/Logic Flaw

The registeruser function in client/newaccountform.php in Domain Technologie Control DTC before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...