Facebook Privacy Feature Gone for Good

Late last year the world’s largest social network announced that it would begin removing a popular privacy feature that let users regulate whether other users could search for and locate their profiles with the Facebook search function. At the time of its initial announcement, the social networki...

IBM WebSphere Commerce 拒绝服务漏洞(CVE-2013-2992)

BUGTRAQ ID: 62093 CVECAN ID: CVE-2013-2992 IBM WebSphere Commerce是业界领先的下一代电子商务解决方案。 IBM WebSphere Commerce 7.0在"search"功能的实现上存在拒绝服务漏洞，根据搜索条目关联配置情况，远程攻击者通过特制的查询，利用此漏洞可造成服务停止影响。 0 IBM WebSphere Commerce Enterprise 7.x IBM WebSphere Commerce 7.x 厂商补丁： IBM --- IBM已经为此发布了一个安全公告（21648644）以及相应补丁:...

CodeBlocks 12.11 (OSX) - Crash (PoC)

Exploit Title: CodeBlocks 12.11 Mac OS X Crash POC Date: 27-05-2013 Exploit Author: ariarat Vendor Homepage: http://www.codeblocks.org Software Link: http://sourceforge.net/projects/codeblocks/files/Binaries/12.11/MacOS/codeblocks-12.11-mac.dmg Version: 12.11 Tested on: Mac OS X 10.7.5...

PayPal.com Cross Site Scripting

Hello all! I'm Robert Kugler a 17 years old German student who's interested in securing computer systems. I would like to warn you that PayPal.com is vulnerable to a Cross-Site Scripting vulnerability! PayPal Inc. is running a bug bounty program for professional security researchers...

CVE-2013-0786

The Bugzilla::Search::buildsubselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debu...

Design/Logic Flaw

The Bugzilla::Search::buildsubselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debu...

CVE-2013-0786

The Bugzilla::Search::buildsubselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debu...

CVE-2013-1107: Exposure of Sensitive Information to an Unauthorized Actor

The search function in Cisco Webex Social formerly Cisco Quad allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235...

Spotify 0.8.2.610 (search func) Memory Exhaustion Exploit

Exploit for windows platform in category local exploits !/usr/local/bin/perl Spotify 0.8.2.610 search func Memory Exhaustion Exploit Vendor: Spotify Ltd Product web page: http://www.spotify.com Affected version: 0.8.2.610.g090a06f8 Summary: Think of Spotify as your new music collection. Your...

Spotify 0.8.2.610 (search func) Memory Exhaustion Exploit

Summary Think of Spotify as your new music collection. Your library. Only this time your collection is vast: millions of tracks and counting. Spotify comes in all shapes and sizes, available for your PC, Mac, home audio system and mobile phone. Wherever you go, your music follows you. Description...

Tube Ace Cross Site Scripting

Exploit Title: Tube AceAdult PHP Tube Script XSS Vulnerability Date: 15/02/2012 Author: Daniel Godoy Author Mail: DanielGodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: Tube Ace http://www.tubeace.com Tested on: Linux Dork: "?viewStandard=0" Comment Greetz: Hernan...

Unfixed XSS vulnerability at museum.samgd.ru

Security researcher Atmon3r, has submitted on 24/12/2011 a cross-site-scripting XSS vulnerability affecting museum.samgd.ru, which at the time of submission ranked 998031 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 24/12/2011. It is current...

Unfixed XSS vulnerability at www.ulm.de

Security researcher cAs, has submitted on 15/12/2011 a cross-site-scripting XSS vulnerability affecting www.ulm.de, which at the time of submission ranked 183885 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2011. It is currently unfixe...

AlldataSheet Cross Site Scripting

Title: AlldataSheet Domains Cross Site Scripting Author: 3spi0n About AlldataSheet ; Alldatasheet was constructed in 2003 to help Engineers to find datasheet fast, easy and effective from vast volume. Since 2008, Alldatasheet became the most popular and powerful site for search datasheets. Poc...

Yet Another CMS 1.0 Cross Site Scripting / SQL Injection

Advisory: Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities Advisory ID: SSCHADV2011-031 Author: Stefan Schurtz Affected Software: Successfully tested on Yet Another CMS 1.0 Vendor URL: http://yetanothercms.codeplex.com/ Vendor Status: informed ========================== Vulnerability...

Qianbo Enterprise Web Site Management System Cross Site Scripting

cross site scripting XSS Vulnerability + Portal Name : qianbo + software : http://www.qianbo.com.cn + Author : d3c0der + Contact : [email protected] + Google dork : Web Site Technology Framework$B!'BQianbo Enterprise Web Site Management System Copyright...

Unfixed XSS vulnerability at www.gamerevolution.com

Security researcher Moonzorg, has submitted on 19/02/2011 a cross-site-scripting XSS vulnerability affecting www.gamerevolution.com, which at the time of submission ranked 15855 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is...

Auto Database System 1.0 Infusion Addon - SQL Injection

Auto Database System 1.0 Infusion Addon - SQL Injection Exploit Title: PHP-Fusion Auto Database System 1.0 Infusion SQL injection Date: 8-2-2011 Author: Saif El-Sherei Software Link: http://www.php-fusion.co.uk/infusions/addondb/view.php?addonid=146 Version: Auto Database System 1.0 Infusion,...

PHP-Fusion Auto Database System 1.0 Infusion SQL Injection

Exploit Title: PHP-Fusion Auto Database System 1.0 Infusion SQL injection Date: 8-2-2011 Author: Saif El-Sherei Software Link: http://php.opensourcecms.com/scripts/redirect/download.php?id=480 Version: Auto Database System 1.0 Infusion, PHP-fusion 7.01..03 Tested on: Firefox 3.0.15, , IE 8, mySQL...

CmsEasp 2.0.0 XSS vulnerability

易通企业网站系统也称易通企业网站程序，是易通公司开发中国首套免费提供企业网站模板的营销型企业网站管理系统，系统前台生成html、完全符合SEO、同时有在线客服、潜在客户跟踪、便捷企业网站模板制作、搜索引擎推广等功能的企业网站系统。 CmsEasy 2.0.0 null http://server/index.php?act=search&case=%3Cscript%3Ealert%28/xss/%29%3C/script%3E...