[DSECRG-08-007] OpenBSD BGPD daemon Web Interface XSS.

DSECRG-08-007 Digital Security Research Group DSecRG Advisory Application: OpenBSD BGPD daemon Versions Affected: OpenBSD 4.1 Vendor URL: http://openbsd.org Bugs: XSS Exploits: YES Reported: 10.10.2007 Vendor response: 10.10.2007 Date of Public Advisory: 31.01.2008 Authors: Alexandr Polyakov, Ant...

DSECRG-08-006.txt

It is updated version of advisory. updated info in "Fix Information" part, mistake in vendor name. Digital Security Research Group DSecRG Advisory DSECRG-08-006 Application: Nucleus CMS Versions Affected: 3.31 Vendor URL: http://nucleuscms.org Bugs: XSS Injection in URL Exploits: YES Reported:...

Nucleus 3.31 XSS in path

Hello. Digital Security Research Group DSecRG Advisory DSECRG-08-006 Application: Nucleus CMS Versions Affected: 3.31 Vendor URL: http://nucleuscms.org Bugs: XSS Injestion in URL Exploits: YES Reported: 16.01.2008 Vendor response: 18.01.2008 Date of Public Advisory: 29.01.2008 Authors: Alexandr...

phpCMS 1.2.2 - 'file' Remote File Disclosure

Digital Security Research Group DSecRG Advisory DSECRG-08-005 Application: phpCMS Versions Affected: 1.2.2 Vendor URL: http://www.phpcms.de Bug: Remote File Disclosure, Get admin password Exploits: YES Reported: 10.01.2008 Vendor response: 12.01.2008 Date of Public Advisory: 29.01.2008 Authors:...

phpCMS 1.2.2 - file Remote File Disclosure

phpCMS 1.2.2 - file Remote File Disclosure Digital Security Research Group DSecRG Advisory DSECRG-08-005 Application: phpCMS Versions Affected: 1.2.2 Vendor URL: http://www.phpcms.de Bug: Remote File Disclosure, Get admin password Exploits: YES Reported: 10.01.2008 Vendor response: 12.01.2008 Dat...

Web Wiz Forums Directory traversal

WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz ForumsTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal Vulnerable Version: 9.07 Exploit: Available Fix Available: No! Fast Solution is available. - Description: Web Wiz Forums bulletin board system is the ideal forum...

Web Wiz Forums 9.07 - sub Directory Traversal

Web Wiz Forums 9.07 - sub Directory Traversal WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz ForumsTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal Vulnerable Version: 9.07 Exploit: Available Fix Available: No! Fast Solution is available. - Description: Web Wiz...

Web Wiz NewsPad 1.02 - sub Directory Traversal

Web Wiz NewsPad 1.02 - sub Directory Traversal WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz NewsPadTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal Vulnerable Version: 1.02 Exploit: Available Fix Available: No! Fast Solution is available. - Description: Web Wiz...

Bloofox CMS SQL Injection (Authentication bypass) , Source code disclosure

WwW.BugReport.ir AmnPardaz Security Research Team Title:Bloofox CMS Vulnerabilities Vendor: http://www.bloofox.com Bugs: SQL Injection Authentication bypass , Source code disclosure Vulnerable Version: 0.3 prior versions also may be affected Exploitation: Remote with browser Fix Available: No! -...

bloofox 0.3 - SQL Injection File Disclosure

bloofox 0.3 - SQL Injection File Disclosure WwW.BugReport.ir AmnPardaz Security Research Team Title:Bloofox CMS Vulnerabilities Vendor: http://www.bloofox.com Bugs: SQL Injection Authentication bypass , Source code disclosure Vulnerable Version: 0.3 prior versions also may be affected Exploitatio...

mswinqueue-overflow.txt

/ Windows Message Queuing Service Remote RPC BOF Exploit MS07-065 Mod of axis's code. CHANGELOG - added dnsname as a parameter, before it was hardcoded in the request data. Marcin Kozlowski Provided for legal security research and testing purposes ONLY Go through the code : / include include...

MS Windows Message Queuing Service RPC BOF Exploit (dnsname)

Exploit for unknown platform in category remote exploits ============================================================ MS Windows Message Queuing Service RPC BOF Exploit dnsname ============================================================ / Windows Message Queuing Service Remote RPC BOF Exploit...

MS Windows Message Queuing Service RPC BOF Exploit (dnsname)

No description provided by source. / Windows Message Queuing Service Remote RPC BOF Exploit MS07-065 Mod of axis's code. CHANGELOG - added dnsname as a parameter, before it was hardcoded in the request data. Marcin Kozlowski Provided for legal security research and testing purposes ONLY Go throug...

Aria 0.99-6 (effect.php page) Local File Inclusion Vulnerability

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public...

DSECRG-08-002.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

[DSECRG-08-002] Local File Include in arias 0.99-6

Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of Public Advisory: 15.01.2008 Authors:...

Aria 0.99-6 - page Local File Inclusion

Aria 0.99-6 - page Local File Inclusion Digital Security Research Group DSecRG Advisory DSECRG-08-002 Application: aria-0.99-6 Web based ERP Versions Affected: aria-0.99-6 Vendor URL: http://www.tucows.net/ Bug: Local File Include Exploits: YES Reported: 09.01.2008 Vendor Response: None Date of...

Blog:CMS 4.2.1b - SQL Injection Cross-Site Scripting

Blog:CMS 4.2.1b - SQL Injection Cross-Site Scripting Digital Security Research Group DSecRG Advisory DSECRG-08-003 Application: Blogcms Versions Affected: Blogcms 4.2.1b Vendor URL: http://blogcms.com/ Bugs: SQL Injestions, SiXSS, XSS Exploits: YES Reported: 15.01.2008 Vendor response: 16.01.2008...

Blog:CMS 4.2.1b - SQL Injection / Cross-Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-08-003 Application: Blogcms Versions Affected: Blogcms 4.2.1b Vendor URL: http://blogcms.com/ Bugs: SQL Injestions, SiXSS, XSS Exploits: YES Reported: 15.01.2008 Vendor response: 16.01.2008 Date of Public Advisory: 16.01.2008 Authors: Alexand...

SA-2008-007 - Drupal core - Cross site scripting (register_globals)

When theme .tpl.php files are accessible via the web and the PHP setting registerglobals is set to enabled, anonymous users are able to execute cross site scripting attacks via specially crafted links. Drupals .htaccess attempts to set registerglobals to disabled and also prevents access to...