Fixed in Apache Tomcat 8.0.0-RC3

Note: The issue below was fixed in Apache Tomcat 8.0.0-RC2 but the release vote for 8.0.0-RC2 did not pass. Therefore, although users must download 8.0.0-RC3 to obtain a version that includes a fix for this issue, version 8.0.0-RC2 is not included in the list of affected versions. Important:...

Fedora 20 : polkit-0.112-1.fc20 (2013-17160)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...

WordPress Plugin Lazy SEO 1.1.9 - Arbitrary File Upload

WordPress Plugin Lazy SEO 1.1.9 - Arbitrary File Upload Exploit Title : Wordpress Lazy SEO plugin Shell Upload Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork: : inurl:/wp-content/plugins/lazy-seo/ Date: 2013/09/21 Vendor Homepage : http://wordpress.org/plugins/lazy-seo...

WordPress Lazy SEO 1.1.9 Shell Upload

Exploit Title : Wordpress Lazy SEO plugin Shell Upload Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork: : inurl:/wp-content/plugins/lazy-seo/ Date: 2013/09/21 Vendor Homepage : http://wordpress.org/plugins/lazy-seo Software Link :...

WordPress Plugin Lazy SEO 1.1.9 - Arbitrary File Upload

Exploit Title : Wordpress Lazy SEO plugin Shell Upload Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork: : inurl:/wp-content/plugins/lazy-seo/ Date: 2013/09/21 Vendor Homepage : http://wordpress.org/plugins/lazy-seo Software Link :...

Fedora 18 : polkit-0.107-6.fc18 (2013-17197)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...

Fedora 19 : polkit-0.112-1.fc19 (2013-17191)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...

polkit security update

CentOS Errata and Security Advisory CESA-2013:1270 Updated polkit packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

WordPress Simple Dropbox 1.8.8 Shell Upload

Exploit Title : Wordpress Simple Dropbox Upload plugin File Upload Exploit Author : Ashiyane Digital Security Team Download Link : http://wordpress.org/plugins/simple-dropbox-upload-form/ Home : www.Ashiyane.org Version : 1.8.8 Security Risk : High Dork :...

WordPress Mukioplayer 1.6 SQL Injection

Exploit Title : Wordpress Mukioplayer plugin SQL Injection Exploit Author : Ashiyane Digital Security Team Download Link : http://code.google.com/p/mukioplayer4wp/ Home : www.Ashiyane.org Version : 1.6 Security Risk : Medium Dork :...

Cinfores SQL Injection

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | / Exploit Title: Cinfores Sql Injection Vulnerability | | \ Exploit Author: Ashiyane Digital Security Team | | / Softeare Link : http://www.cinfores.com | | \ Google...

Ceder Plus SQL Injection

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | / Exploit Title: Ceder plus Sql Injection Vulnerability | | \ Exploit Author: Ashiyane Digital Security Team | | / Software Link : http://www.cedar-plus.com | | \ Googl...

ICT Studio SQL Injection

Exploit title : ICT Studio Sql injection vulnerability + Software link : http://www.ictstudio.ie + Exploit Author : Ashiyane Digital Security Team + Tested on: Windows 7 , Linux + Google Dork : intext:"Powered by ICT Studio" + Date: 2013/09/11...

SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS)

This jQuery Countdown Module enables you to display a countdown block based upon date settings. The jQuery Countdown Module does not properly sanitize the settings, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting XSS vulnerability. This vulnerability ...

SA-CONTRIB-2013-075 - Click2Sell - Multiple Vulnerabilities (XSS and CSRF)

Click2Sell is an Affiliate Marketing Network which lets you sell your products through their marketplace or on your website with buy it now buttons, and which also allows you to access hundreds of affiliates who want to sell your product for you and earn commission. Reflected Cross Site Scripting...

Interalp Touristik SQL Injection

Exploit Title : Interalp Touristik Sql injection Vulnerabilites Exploit Author : Ashiyane Digital Security Team Software Link : http://interalp-touristik.com Tested on: Windows 7 , Linux Google Dork : intext:"powered by Interalp Touristik" Date: 2013/09/10...

CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework

Severity: Important Vendor: Spring by Pivotal Versions Affected: - 3.0.0 to 3.2.3 Spring OXM & Spring MVC - 4.0.0.M1 Spring OXM - 4.0.0.M1-4.0.0.M2 Spring MVC - Earlier unsupported versions may also be affected Description: The Spring OXM wrapper did not expose any property for disabling entity...

Updated [CVE-2013-2136] Apache CloudStack Cross-site scripting (XSS) vulnerabiliity

Issued: August 6, 2013 Updated: August 7, 2013 Product: Apache CloudStack Vendor: The Apache Software Foundation Vulnerability Types: Cross-site scripting XSS Vulnerable versions: Apache CloudStack versions 4.0.0-incubating, 4.0.1-incubating, 4.0.2 and 4.1.0 CVE References: CVE-2013-2136 Risk...

CommonMan SQL Injection

Exploit Title : CommonMan Sql injection Vulnerabilites Software link : http://www.cmiti.com Exploit Author : Ashiyane Digital Security Team Tested on: Windows 7 , Linux Google Dork : intext:"Site Powered by CommonMan Technologies" Date: 2013/09/07...

SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass

This module enables you to create polls accessible by an url with hash e.g. example.com/makemeeting/sn9028xh3398 so that anonymous users can view and vote on the poll. The module didn't sufficiently check access when a poll is accessed directly via its node url e.g. node/123. Note: a user with th...