SA-CONTRIB-2014-073- Date - Cross Site Scripting (XSS)

Date module provides flexible date/time field type Date field and a Date API that other modules can use. The module incorrectly prints date field titles without proper sanitization thereby opening a Cross Site Scripting XSS vulnerability. The vulnerability is mitigated by the fact that an attacke...

Fixed in Apache Tomcat 7.0.55

Important: Request Smuggling CVE-2014-0227 It was possible to craft a malformed chunk as part of a chunked request that caused Tomcat to read part of the request body as a new request. This was fixed in revision 1601333. This issue was identified by the Tomcat security team on 30 May 2014 and mad...

vBulletin 5.1.2 SQL Injection

?php / Author: Nytro Powered by: Romanian Security Team Price: Free. Educational. / errorreportingEALL; iniset'displayerrors', 1; // Get arguments $targeturl = isset$argv1 ? $argv1 : 'https://rstforums.com/v5'; $expression = strreplace'/', '\/', $targeturl; // Function to send a POST request...

SA-CONTRIB-2014-070 - Password Policy - Access Bypass

The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. Access Bypass 7.x only Password Policy has a Password Change Tab submodule which provides a tab for a user to change their password. Password Policy also has a...

SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS)

This module enables you to customise the standard Drupal registration and login processes. Cross Site Scripting The module doesn't filter user-supplied information from the URL resulting in a reflected Cross Site Scripting XSS vulnerability. Access Bypass The module introduces a concept of a...

SA-CONTRIB-2014-067 - Meta Tags Quick - Multiple vulnerabilities

Meta tags quick adds meta tags editing to all non-administrative pages of Drupal site. Redirector abuse in path-based meta tag editing form When editing a path-based meta tag, module does not check destination parameter of the URL, allowing attacker to pass arbitrary URL to meta tag editing form...

ZipScan 2.2c SEH

No description provided by source. !/usr/bin/perl Software : ZipScan 2.2c .zip Bug found by : Lincoln Author : Lincoln & corelanc0d3r OS : Windows Tested on : XP SP3 En VirtualBox Type of vuln : SEH Greetz to : Corelan Security Team...

Wordpress Count-per-day plugin Multiple Vulnerabilities

No description provided by source. Exploit Title: Count-per-day Wordpress plugin Arbitrary file download and XSS Version: 3.1.1 Date: 2011-01-12 Author 6Scan http://6scan.com security team Software Link: http://wordpress.org/extend/plugins/count-per-day/ Official fix: This advisory is released...

OneForum (topic.php) SQL Injection Vulnerability

No description provided by source. Title : OneForum SQL Injection Vulnerability Author : Red Security TEAM Date : 22/02/2012 Risk : High Software : http://www.onescripts.de/ Download : http://www.onescripts.de/download/oneforum.zip Tested On : CentOS Contact : Info at RedSecurity . COM Home :...

Heaven Soft CMS 4.7 - SQL Injection Vulnerability

No description provided by source. x Tybe: SQL Injection Vulnerabilities x Vendor: http://www.newyorkindoorcricket.com/ x Script Name: Heaven Soft, CMS Version: 4.7 x author: PrinceofHacking x Team: Ashiyane Digital Security Team x Mail : PrincedotH4ck@gmaildotcom D0rk:photogalleryshow.php?id...

vBulletin(R) 3.8.6 faq.php Information Disclosure Vulnerability

No description provided by source. 010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 010101010101010101010101010101010101010101010101010101010 Original Advisory:...

goffgrafix Design's SQL Injection Vulnerability

No description provided by source. ========================================================= goffgrafix Design's SQL Injection Vulnerability ========================================================= Name: goffgrafix Design's SQL Injection Vulnerability Date: 2010-05-23 vendor: www.goffgrafix.com...

BBMedia Design's SQL Injection Vulnerability

No description provided by source. ========================================================= BBMedia Design's SQL Injection Vulnerability ========================================================= Name: BBMedia Design's SQL Injection Vulnerability Date: 2010-05-23 vendor: http://www.bbmedia.org...

Lotus Core CMS 1.0.1 - Remote File Inclusion Vulnerabilities

No description provided by source. phpbb3 Lotus Core CMS v1.0.1 Remote File Include Vulnerabilities Discovered by : Ciph3r MAIL : [email protected] SP TANX4 : Iranian hacker & Kurdish Security TEAM CLASS : remote download cms: http://sourceforge.net/project/showfiles.php?groupid=215112 C0d...

Joomla Component altas 1.0 - Multiple Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Joomla Component altas v 1.0 Multiple Remote SQL Injection variables vuln : ano & mes Found by : Houssamix From H-T Team H-T Team HouSSaMix + ToXiC350 Greetz : Islamic Security Team & and all musulmans hackers ComponentName: altas ScriptName:...

PHPSelect Submit-A-Link HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/17348/info Submit-A-Link is prone to an HTML-injection vulnerability. The script fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code woul...

DJ Studio Pro 8.1.3.2.1 - SEH Exploit

No description provided by source. DJ Studio Pro Version 8.1.3.2.1 SEH 0 day Author Abhishek Lyall - abhilyallatgmaildotcom, infoataslitsecuritydotcom Web - http://www.aslitsecurity.com/ Blog - http://www.aslitsecurity.blogspot.com/ Download Vulnerable application from...

SourceForge <= 1.0.4 (database.php) Remote File Include Exploit

No description provided by source. !/usr/bin/perl SourceForge-1.0.4 remote Command Execution Vulnerabilities Risk : High Remote Code Execution Url: http://lbdpc15.epfl.ch/ibd/IBD2000/SourceForge-1.0.4.tgz Exploit: http://site.com/path/include/database.php?sysdbtype=EvilScript coded and f0und3d by...

PHP Forge <= 3 beta 2 (cfg_racine) Remote File Inclusion Vulnerability

No description provided by source. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ phpforge3b2cfgracine Remote File Inclusion Vulnerability ------------------------ Virangar Security Team www.virangar.org public www.virangar.net priv8 -------- Discoverd By : Snake...

php-nuke platinum 7.6.b.5 - Remote File Inclusion Vulnerability

No description provided by source. ---------------------------------------------- GrEeTs To -=sHaDoW sEcUrItY TeAm=- GrEaTs To ---------------------------------------------- A2J, Chucks, The Pitbull, ICQBomber, str0ke ---------------------------------------------- BiG sHoUt OuT tO udplink.net &...