Endian Firewall 2.4 - 'dnat.cgi?createrule' Cross-Site Scripting

source: https://www.securityfocus.com/bid/52076/info Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal...

JEECMS后台任意文件编辑漏洞and官方漏洞及拿shell

简要描述： JEECMS后台任意文件编辑漏洞以及官方的demo站、官方服务器安全问题 详细说明： 2.x后台： login/Jeecms.do 3.x后台： jeeadmin/jeecms/index.do 默认账户：admin 默认密码：password 获取tomcat密码： /jeeadmin/jeecms/template/vedit.do?root=../../conf/&name=../../conf/tomcat-users.xml 获取JDBC数据库账号密码：...

Joomla! Component Module Simple File Upload 1.3 - Remote Code Execution

?PHP / -------------------------------------------------------------------------------- Title: Simple File Upload v1.3 module for joomla Remote Code Execution Exploit -------------------------------------------------------------------------------- Author...............: gmda Google...

DNS and DNSSEC Fuzzer

This module will connect to a DNS server and perform DNS and DNSSEC protocol-level fuzzing. Note that this module may inadvertently crash the target server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

Tor Project Sets Up Cloud Bridge Project on Amazon EC2

The Tor Project has started a new system designed to help people start and run Tor bridges in the cloud using Amazon’s EC2 platform. The Tor Cloud runs on Amazon’s new micro-instance tier that lets people run instances for free for the first year. Tor is used by people around the world to help...

[SECURITY] Fedora 14 Update: cyrus-imapd-2.3.18-1.fc14

The cyrus-imapd package contains the core of the Cyrus IMAP server. It is a scaleable enterprise mail system designed for use from small to large enterprise environments using standards-based internet mail technologies. A full Cyrus IMAP implementation allows a seamless mail and bulletin board...

DEDECMS get SHELL EXP-vulnerability warning-the black bar safety net

Network transmission is said to know the background to use, but don't, as long as the plus the directory exists, the server can even outside, you can get the shell www.t00ls.net5 G$ w& h" m! n9 S: G Before the title conditions, you must ready yourself for the dede database, and then insert the...

Pakistani Matrimonial Website 'PakRishta' defaced by Cyb3r R3b3li@nZ

Pakistani Matrimonial Website 'PakRishta ' defaced by Cyb3r R3b3li@nZ Pakistani Matrimonial Website 'PakRishta.com ' defaced by Hacker name "Cyb3r R3b3li@nZ " . Hacker said "This site is just hacked to inform the admin to remove the file uploading vulnerabilities in the profile picture uploading...

Network odd CWMS enterprise website Management System 3. 0 editor vulnerability-vulnerability warning-the black bar safety net

Network odd CWMS enterprise website Management System 3. 0 vulnerability google: the Powered by wqCWMS 3.0 Default account password: wangqi wagnqi I can't find anything else that gets the account password the way. Into the background, add article, see the editor Then browse the server myself, fck...

Nmap NSE net: sslv2

Determines whether the server supports obsolete and less secure SSLv2, and discovers which ciphers it supports. OpenVAS Vulnerability Test $Id: gbnmapsslv2net.nasl 5499 2017-03-06 13:06:09Z teissa $ Autogenerated NSE wrapper Authors: NSE-Script: Matthew Boyle NASL-Wrapper: autogenerated Copyright...

Xymon Detection

Detection of Xymon The script sends a connection request to the server and attempts to detect Xymon and to extract its version. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

WordPress.Com Hacked, Hacker root the Server !

WordPress.Com Hacked, Hacker Root the Server ! The parent company that operates WordPress, made an announcement this morning that it has hacked, resulting what the company said was a low-level root break-in to several of their servers. The company warned that potentially anything on those servers...

I-COM 1.0 Local File Inclusion

Exploit Title : I-COM web Development LFI Vulnerability Author : ThunDEr HeaD Contact : [email protected] Date : 10-01-2011 HomePage : www.indishell.in Verstion : 1.0 Tested on : Sites By I-com Vulnerability Style : local file inclusion Vulnerability Dir : Directory traversal Greetz To...

Awstats statistics permissions assigned improperly leads to explosive path-vulnerability warning-the black bar safety net

Vulnerability details Brief description: Awstats statistics permissions assigned improperly leads to explosive path Detailed description: Awstats is a Perl-based WEB Log analysis and Statistics tool. Due to the simplicity of powerful features and by many administrators of all ages, its default...

SSH password weakness

Added: 01/05/2011 CVE: CVE-1999-0502 Background Passwords are the most commonly used method of authenticating users to a server. The combination of a login name and password is used to verify the identity of a user requesting access, and to determine what parts of the server the user has permissi...

Users Credit Card Information Stolen by Hackers from CitySights NY Website !

Most of us believe that by making online purchases through a secure website, with reputable companies, our credit card information is safe, right. That is not entirely true, as users of the popular website, CitySights NY recently discovered. You see, while the site itself may be secure, the...

JavaScript eval() Usage on Web Server

Binary data 5723.prm...

Pakistani Server Rooted By Indishell ( 1000+ sites owned )

Pakistani Server Rooted By Indishell 1000+ sites owned Indishell rooted "94.228.216.159 " server and check the sites which are listed here is the screen shot of the ssh of the server . Here Is The Screen of Whm in which Cyberhaxors.com Cpanel is Still there : Indishell Got There IP logs , FTP Log...

69.69.247.90 Server Rooted By "Rat Techie"

Finally 69.69.247.90 Server Rooted By "Rat Techie" There are 100's of sites on the server, some of them are ... answerjeffersoncity.com apoplew.com apsemo.org bgcjeffersoncity.org bisgeslaw.com bluegrassmartins.com bookandtoy.net bookrak.com cabllc.com call-sti.com callstihelp.com capitaldiesel.c...

PYSEC-2010-21

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attemptedlogins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack...