SA-CONTRIB-2012-170 - MultiLink - Access Bypass

MultiLink allows you to generate in-content links to a suitable node or node translation based on the visitor's language preferences. It allows the Node Title of the target node to be shown as the visible text and title attribute for the generated link. Prior to versions 6.x-2.7 and 7.x-2.7 the...

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)

This module provides integration with the Mixpanel real-time analytics service. The module doesn't sufficiently escape the Mixpanel token when adding the tracking Javascript to the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access...

SA-CONTRIB-2012-172 - Zero Point - Cross Site Scripting (XSS)

Zero Point is an advanced theme which includes many options, ideal for a wide range of sites. The theme does not escape path aliases exposing a Cross site scripting XSS vulnerability in URLs. There are no mitigating factors. CVE: CVE-2012-5591 Versions affected zeropoint 6.x-1.x versions prior to...

WordPress Myflash Local File Inclusion

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title: Wordpress Myflash Plugin | Local File Inclusion Vulnerability | Google Dork: inurl:"/myflash/myextractXML.php?path=" Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on: Windows 7 | | Locatio...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 156567 High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz. 148638 Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG. 155711 Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász. 158249 Hi...

WordPress Oberliga SQL Injection

Exploit Title : Wordpress oberliga theme Sql Injection Author : Ashiyane Digital Security Team Discovered By : sil3nt Home : www.ashiyane.org/ Security Risk : High - SQL Injection Dork : inurl:/wp-content/themes/oberligatheme/ajax/team.php Expl0iTs :...

WordPress Ads Box SQL Injection

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title: Wordpress Ads box Plugin Sql | Injection Vulnerability | Google Dork:"inurl:/iframeampl.php" Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on: Windows 7 | | Location:...

Wordpress Plugin plg_novana Sql Injection Vulnerability

WordPress Plg Novana third party plugin suffers from a remote SQL injection vulnerability. Exploit Title : Wordpress plgnovana plugin Sql Injection Exploit Author : Ashiyane Digital Security Team Discovered By : sil3nt Home : www.ashiyane.org Security Risk : High - SQL Injection Dork :...

WordPress Zarzadzanie Kontem Shell Upload

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title: Wordpress zarzadzaniekontem Plugin | Arbitrary File Upload Vulnerability | Google Dork: inurl:"/wp-content/plugins/zarzadzaniekontem/" Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on:...

WordPress Plg Novana SQL Injection

Exploit Title : Wordpress plgnovana plugin Sql Injection Exploit Author : Ashiyane Digital Security Team Discovered By : sil3nt Home : www.ashiyane.org Security Risk : High - SQL Injection Dork : inurl:/plugins/plgnovana/novanadetail.php Expl0iTs :...

WordPress Zingiri Web Shop 2.5.0 Shell Upload

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title: Wordpress Zingiri-web-shop 2.5.0 Plugin | Arbitrary File Upload Vulnerability | Version: 2.5.0 Software Link: www.zingiri.com/plugins-and-addons/web-shop/ Google Dork: inurl:"/wp-content/plugins/zingiri-web-shop/" Exploit...

WordPress Madebymilk SQL Injection

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title: Wordpress madebymilk Theme SQL Injection | Google Dork: inurl:/madebymilk/voting-popup.php | Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on: Windows 7 | | Location:...

Use-after-free and buffer overflow issues found using Address Sanitizer — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team discovered a series critically rated of use-after-free and buffer overflow issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We wou...

FreeBSD : typo3 -- Multiple vulnerabilities in TYPO3 Core (79818ef9-2d10-11e2-9160-00262d5ed8ee)

Typo Security Team reports : TYPO3 Backend History Module - Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability. Credits go to Thomas Worm who discovered and reported th...

WordPress ArribaLaEsteban SQL Injection

|| | || || | | | | 0 | In the name of GOD | -|- | | | ||||| Exploit Title:Wordpress | ArribaLaEsteban theme SQL Injection Vulnerability | Google Dork: inurl:/estadisticas/fichajugador.php Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on: Windows 7 | | Location:...

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)

The Chaos tool suite is primarily a set of APIs and tools to improve the developer experience. The page manager node view task does not sufficiently escape node titles when setting the page title, allowing XSS. This vulnerability is partially mitigate by the node task being disabled by default an...

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)

This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently verify POST requests thereby exposing a Cross Site Request Forgery vulnerability. This vulnerability is...

Skype Account Service - Expire Token Bypass Vulnerability

Document Title: =============== Skype Account Service - Expire Token Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=762 Download: http://www.vulnerability-lab.com/resources/videos/762.wmv View: http://www.youtube.com/watch?v=lrNj785QQlg Advisory:...

WordPress Related Posts Exit Popup SQL Injection

In the name of GOD Exploit Title: Wordpress relatedpostsexitpopup SQL Injection Vulnerability Google Dork: inurl:"/relatedpostsexitpopupwindow.php" OR intitle:"Thanks for visiting our site" Exploit Author: Ashiyane Digital Security Team Category: Web Application Tested on: Windows 7 Location:...

WordPress Calendar-Script Blind SQL Injection

Exploit Title: Wordpress Calendar-Script Plugin Blind SQL Injection Vulnerability Google Dork: inurl:"/Calendar-Script/load.php?cid=1" or "intext:Copyright phpcalendarscripts.com ©" Exploit Author: Ashiyane Digital Security Team Vendor Homepage: http://phpcalendarscripts.com/ Tested on: Windows 7...