CVE-2015-0967

Multiple cross-site scripting XSS vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via 1 the search field in plugin/index.html or 2 the title field in the Create Featured Result form in admin/main.jsp...

[SECURITY] Fedora 21 Update: drupal7-webform-4.7-1.fc21

Webform is the module for making surveys in Drupal. After a submission, users may be sent an e-mail "receipt" as well as sending a notification to administrators. Results can be exported into Excel or other spreadsheet applications. Webform also provides some basic statistical review and has and...

PT-2015-5288

Name of the Vulnerable Software and Affected Versions Asus RT-N10+ D1 router version 2.1.1.1.70 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the flag parameter i...

CVE-2015-1052: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the poll archive in PHPKIT 1.6.6 Build 160014 allows remote attackers to inject arbitrary web script or HTML via the result parameter to uploadfiles/pk/include.php...

PT-2015-5039

Name of the Vulnerable Software and Affected Versions PHPKIT version 1.6.6 Build 160014 Description A cross-site scripting XSS issue exists in the poll archive of PHPKIT, allowing remote attackers to inject arbitrary web script or HTML via the result parameter to "upload files/pk/include.php"...

CVE-2014-0232

Multiple cross-site scripting XSS vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a 1...

CVE-2014-0232: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a 1...

PT-2014-3549

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 11.04.01 through 11.04.04 Apache OFBiz versions 12.04.01 through 12.04.03 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This is due to multiple cross-site...

CVE-2013-7389: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in D-Link DIR-645 Router Rev. A1 with firmware before 1.04B11 allow remote attackers to inject arbitrary web script or HTML via the 1 deviceid parameter to parentalcontrols/bind.php, 2 RESULT parameter to info.php, or 3 receiver parameter to...

PT-2014-3413 · D Link · D-Link Dir-645 Router

Name of the Vulnerable Software and Affected Versions: D-Link DIR-645 Router Rev. A1 with firmware prior to 1.04B11 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the deviceid parameter to the "parentalcontrols/bind.php" endpoint, t...

OpenSSH/PAM <= 3.6.1p1 Remote Users Ident (gossh.sh)

No description provided by source. !/bin/sh OpenSSH = 3.6.p1 - User Identification. Nicolas Couture - [email protected] Description: -Tells you wether or not a user exist on a distant server running OpenSSH. Usage: -You NEED to have the host's public key before executing this script...

LDAP Injection PoC

No description provided by source. + Vurnerebility: LDAP Injection + Category : Implemented Web exploit + Category : Attack Technique + Author : mc2s3lector + dork : X/o\ + Contact : www.yogyacarderlink.web.id + date : 4-2-10 + biGthank to : Allah SWT,jasakom,KeDai Computerworks,0n3-d4y...

mrcgiguy the ticket system 2.0 php Multiple Vulnerabilities

No description provided by source. MRCGIGUY The Ticket System 2.0 PHPid Multiple Remote Vulnerabilities Founder: ThE g0bL!N ------ Home: http:/www.4ckx.com/dz/ ---- Vendor:http://www.mrcgiguy.com Special Thx: All Muslims All Members Of Team Algerien Of FootBall Note: Algerie 3-1 Egypt Exploit:...

openSUSE Security Update : phpMyAdmin (openSUSE-2012-18)

update to 3.4.9 - bug 3442028 edit Inline editing enum fields with null shows no dropdown - bug 3442004 interface DB suggestion not correct for user with underscore - bug 3438420 core Magic quotes removed in PHP 5.4 - bug 3398788 session No feedback when result is empty signon authtype - bug...

openSUSE Security Update : phpMyAdmin (openSUSE-SU-2014:0344-1)

phpMyAdmin was updated to 4.1.8 to fix bugs, security issues and also bring new features. Fixed security issue : - PMASA-2014-1 CVE-2014-1879, CWE-661 CWE-79 - update to 4.1.8 2014-02-22 - sf4276 Login loop on session expiry - sf4249 Incorrect number of result rows for SQL with subqueries - sf427...

openSUSE Security Update : icinga (openSUSE-SU-2014:0069-1)

imported upstream version 1.10.2 - includes fix for possible denial of service in CGI executables: CVE-2013-7108 bnc856837 - core: Add an Icinga syntax plugin for Vim 4150 - LE/MF - core: Document dropped options logexternalcommandsuser and eventprofilingenabled 4957 - BA - core: type in spec...

PT-2014-3495 · Red Hat · Red Hat Cloudforms Management Engine

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms Management Engine CFME versions prior to 5.2.3.2 Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This is related to the MiqReportResult.exists function in the ReportController...

CVE-2013-4500: Undefined Security Weakness

The Quiz module 6.x-4.x before 6.x-4.5 for Drupal allows remote authenticated users with the "view any quiz results" or "view results for own quiz" permission to delete arbitrary results via the delete option...

Amazon Linux AMI : postgresql (ALAS-2011-12)

A signedness issue was found in the way the crypt function in the PostgreSQL pgcrypto module handled 8-bit characters in passwords when using Blowfish hashing. Up to three characters immediately preceding a non-ASCII character one with the high bit set had no effect on the hash result, thus...

Squash YAML Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'zlib' class Metasploit3 'Squash YAML Code...