WordPress Eco-Annu SQL Injection

Exploit Title: Wordpress Eco-annu Plugin SQL Injection Vulnerability Google Dork: inurl:"/eco-annu/map.php?eid=" Exploit Author: Ashiyane Digital Security Team Tested on: Windows 7 Location: http://site.com/wp-content/plugins/eco-annu/map.php?eid=SQL Demo :...

WordPress Kakao Theme SQL Injection

Exploit Title : Wordpress theme kakao Sql Injection Author : Iranian DataCoders Security Team Discovered By : sil3nt Home : www.datacoders.org/ Security Risk : High - SQL Injection Dork : inurl:themes/wilderness/gallery.php Expl0iTs : Target/wp-content/themes/kakao/sonHaberler.php?ID=sql D3m0 :...

CVE-2012-5128

Google V8 before 3.13.7.5, as used in Google Chrome before 23.0.1271.64, does not properly perform write operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

SA-CONTRIB-2012-160 - OM Maximenu - Cross Site Scripting (XSS)

This module enables you to create custom menus with effects and integrate module blocks as it's menu item content. The module doesn't sufficiently state the risk of giving permission to create OM Maximenus. This vulnerability is mitigated by the fact that an attacker must have a role with the...

WordPress Hitasoft FLV Player 1.1 SQL Injection

Exploit Title: Wordpress Hitasoft FLV Player 1.1 SQL Injection Vulnerability Google Dork: inurl:"hitasoftplayer/config.php?id=" Exploit Author: Ashiyane Digital Security Team Software Link: http://hitasoft.com/hitasoftplayer.zip Category: Web Application Version: 1.1 Tested on: Windows 7 Location...

Barracuda EMail Security - Filter Bypass Vulnerability

Document Title: =============== Barracuda EMail Security - Filter Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=579 Download: http://www.vulnerability-lab.com/resources/videos/744.wmv View: http://www.youtube.com/watch?v=r9cwfFta5OY Release Date:...

tomcat -- authentication weaknesses

The Apache Software Foundation reports: Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved: Tomcat tracked client rather than server nonces and nonce count. When a session ID was present, authentication was bypassed. The user name and password were n...

[Joomscan] Now can identify 673 joomla vulnerabilities

Security Team Web-Center just released an updated for Joomscan Security Scanner. The new database Have 673 joomla vulnerabilities Joomla! is probably the most widely-used CMS out there due to its flexibility, user friendlinesss, extensibility to name a few.So, watching its vulnerabilities and...

SA-CONTRIB-2012-157 - Time Spent - Multiple Vulnerabilities - (unsupported)

The Time Spent module tracks the time a registered user spends on a site and a site's content. The module doesn't sufficiently sanitize user input. Cross site scripting, cross-site request forgery, and SQL injection vulnerabilities have all been found. Note that none of these vulnerabilities have...

HZChoice CMS SQL Injection

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- In The Name Of God -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -------------------------------------------------------------------------------- @ HZChoice CMS SQL Vulnerability...

WHMCS v4.5.2 Blind SQL Injection Vulnerability

WHMCS WHMCompleteSolution Affected versions: 4.5.x / || | \ | / | '| \ \ /\ / / | '/ \ | || | | | \ V V / | | | | / |/ \,|| // ,|| | Software : WHMCS WHMCompleteSolution Google Dork: Turn on thinking mode :P Date: 10/22/2012 Author: Starware Security Team www.Resecure.me Contact Us :...

WordPress Plugin FireStorm Professional Real Estate 2.06.01 - SQL Injection

Exploit Title: Wordpress FireStorm Professional Real Estate 2.06.01 SQL Injection Vulnerability Google Dork: inurl:"/fs-real-estate-plugin/xml/markerlistings.xml?id=" Exploit Author: Ashiyane Digital Security Team Software Link: http://www.firestormplugins.com/plugins/real-estate/ Category: Web...

WordPress Plugin FireStorm Professional Real Estate 2.06.01 - SQL Injection

WordPress Plugin FireStorm Professional Real Estate 2.06.01 - SQL Injection Exploit Title: Wordpress FireStorm Professional Real Estate 2.06.01 SQL Injection Vulnerability Google Dork: inurl:"/fs-real-estate-plugin/xml/markerlistings.xml?id=" Exploit Author: Ashiyane Digital Security Team Softwar...

SA-CONTRIB-2012-156 - Search API - Cross Site Request Forgery (CSRF)

This module enables you to build searches using a wide range of features, data sources and backends. The module doesn't sufficiently guard the “enable index” action against Cross Site Request Forgery CSRF attacks which could allow an attacker to enable existing search indexes on your site. This...

Important: Red Hat Security Advisory: openstack-swift security update

Updated openstack-swift packages that fix one security issue are now available for Red Hat OpenStack Essex. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

FileContral 1.0 File Disclosure / Local File Inclusion

------------------IN THE NAME OF GOD-------------------- Title : FileContral v1.0 By Leslee Mulitpe Vulnerabilities Author: Ashiyane Digital Security Team Dork : "intitle:FileContral v1.0 By Leslee" Exploit ----------------- 1 . Local File Inclusion...

SA-CONTRIB-2012-155 - ShareThis - Cross Site Scripting (XSS)

This module enables integration with the ShareThis web service to allow social bookmarking amongst your users. The module doesn't sufficiently filter JavaScript settings before outputting them. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer — Mozilla

Security researcher Abhishek Arya Inferno of the Google Chrome Security Team discovered a series of use-after-free, buffer overflow, and out of bounds read issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We...

FreeBSD : chromium -- multiple vulnerabilities (e6161b65-1187-11e2-afe3-00262d5ed8ee)

Google Chrome Releases reports : 138208 High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG. 147499 Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG. 148692 Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthu...

MyAuth3 - Blind SQL Injection

MyAuth3 - Blind SQL Injection Exploit Title: MyAuth3 Blind SQL Injection / Root Shell Access 0day exploit Google Dork: allinurl:1881/?console=panel Date: 09/06/2011 Author: Marcio Almeida marcioatalligatorteamdot org | @marcioalm Version: 3.0 Tested on: Linux EDB-Note: apparently no true exploit ...