4images 1.7.9 SQL Injection / Path Disclosure

================================ Vulnerability ID: HTB22950 Reference: http://www.htbridge.ch/advisory/sqlinjectionin4images.html Product: 4images Vendor: http://www.4homepages.de/ http://www.4homepages.de/ Vulnerable Version: 1.7.9 Vendor Notification: 07 April 2011 Vulnerability Type: SQL...

WordPress Plugin Ajax Category Dropdown 0.1.5 - Multiple Vulnerabilities

============================= Vulnerability ID: HTB22946 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectioninajaxcategorydropdownwordpressplugin.html Product: Ajax Category Dropdown wordpress plugin Vendor: http://www.dyasonhat.com/ http://www.dyasonhat.com/ Vulnerable Version: 0.1.5...

SocialGrid WordPress Plugin 2.3 Cross Site Scripting

Vulnerability ID: HTB22940 Reference: http://www.htbridge.ch/advisory/xssinsocialgridwordpressplugin.html Product: SocialGrid wordpress plugin Vendor: Michael Whalen http://whalesalad.com Vulnerable Version: 2.3 Vendor Notification: 05 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk...

webSPELL 4.2.2a Cross Site Scripting / Path Disclosure

================================= Vulnerability ID: HTB22932 Reference: http://www.htbridge.ch/advisory/multiplexssinwebspell.html Product: webSPELL Vendor: http://www.webspell.org/ http://www.webspell.org/ Vulnerable Version: 4.2.2a Vendor Notification: 05 April 2011 Vulnerability Type: XSS Cros...

Universal Post Manager WordPress Plugin 1.0.9 SQL Injection

Vulnerability ID: HTB22939 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectioninuniversalpostmanagerwordpressplugin.html Product: Universal Post Manager wordpress plugin Vendor: ProfProjects Artyom Chakhoyan http://www.profprojects.com/ Vulnerable Version: 1.0.9 Vendor Notification: 0...

Universal Post Manager WordPress Plugin 1.0.9 XSS / Path Disclosure

============================== Vulnerability ID: HTB22937 Reference: http://www.htbridge.ch/advisory/pathdisclosureinuniversalpostmanagerwordpressplugin.html Product: Universal Post Manager wordpress plugin Vendor: ProfProjects Artyom Chakhoyan http://www.profprojects.com/ Vulnerable Version: 1.0...

dalbum 1.43 - Multiple Vulnerabilities

dalbum 1.43 - Multiple Vulnerabilities =============================== Vulnerability ID: HTB22941 Reference: http://www.htbridge.ch/advisory/csrfcrosssiterequestforgeryindalbum.html Product: Dalbum Vendor: http://www.dalbum.org/ http://www.dalbum.org/ Vulnerable Version: 1.43 Vendor Notification:...

WP-StarsRateBox WordPress Plugin 1.1 XSS / SQL Injection

================================ Vulnerability ID: HTB22934 Reference: http://www.htbridge.ch/advisory/sqlinjectioninwpstarsrateboxwordpressplugin.html Product: WP-StarsRateBox wordpress plugin Vendor: www.starsrate.com www.starsrate.com Vulnerable Version: 1.1 Vendor Notification: 05 April 2011...

HTB22943: XSS in Dalbum

Vulnerability ID: HTB22943 Reference: http://www.htbridge.ch/advisory/xssindalbum.html Product: Dalbum Vendor: http://www.dalbum.org/ http://www.dalbum.org/ Vulnerable Version: 1.43 Vendor Notification: 05 April 2011 Vulnerability Type: XSS Cross Site Scripting Risk level: Medium Credit: High-Tec...

VUPEN Security Research - Microsoft Windows OpenType CFF Driver Stack Overflow Vulnerability (CVE-2011-0034)

VUPEN Security Research - Microsoft Windows OpenType CFF Driver Stack Overflow Vulnerability CVE-2011-0034 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Windows is a series of software operating systems and graphical user interfaces produced by Microsoft...

VUPEN Security Research - Microsoft Windows OpenType CFF Driver Stack Overflow Vulnerability (CVE-2011-0034)

VUPEN Security Research - Microsoft Windows OpenType CFF Driver Stack Overflow Vulnerability CVE-2011-0034 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Windows is a series of software operating systems and graphical user interfaces produced by Microsoft...

4images 1.7.9 Blind SQL Injecton / Remote File Inclusion

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Multiple Vulnerabilities in WP-StarsRateBox

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WP-StarsRateBox WordPress Plugin which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerability in WP-StarsRateBox The vulnerability exists due to inp...

Cross-site Request Forgery (CSRF) in Plogger

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Plogger which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF vulnerability in Plogger The vulnerability exists due to insufficient validation of the request...

Multiple Vulnerabilities in Viscacha

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Viscacha which could be exploited to perform cross-site scripting attacks and disclose potentially sensitive information. 1 Cross-site scripting XSS vulnerabilities in Viscacha 1.1 The vulnerability exists due to...

Multiple Vulnerabilities in Eleanor CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Eleanor CMS which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerability in Eleanor CMS The vulnerability exists due to input sanitation error in the...

Cross-site Request Forgery (CSRF) Vulnerability in InTerra Blog Machine

High-Tech Bridge SA Security Research Lab has discovered vulnerability in InTerra Blog Machine which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF vulnerability in InTerra Blog Machine: CVE-2011-1670 The vulnerability exists due to insufficien...

VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free

VUPEN Security Research - Apple Safari WebKit Iframe Event Handling Remote Use-after-free http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Apple Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with 4.45...

[DCA-2011-0001] TP-LINK TL-WR740N Multiple Vulnerabilities - Stored XSS - Web Console and Upnp server DoS

DCA-2011-0001 Discussion - DcLabs Security Research Group advises about following vulnerabilityies: Software/Hardware - TP-LINK TL-WR740N Vendor Product Description - The TL-WR740N is a combined wired/wireless network connection device integrated with internet-sharing router and 4-port switch. Th...

Multiple Vulnerabilities in SyndeoCMS

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in SyndeoCMS which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerabilities in SyndeoCMS 1.1 The vulnerability exists due to input sanitation error in...