Whois Cart Billing Cross Site Scripting / Disclosure

Title: ====== Whois Cart Billing - Multiple Web Vulnerabilities Date: ===== 2011-12-22 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=343 VL-ID: ===== 343 Introduction: ============= Whois.Cart is a client/administrator tool that facilitates the many tasks involved in...

Barracuda Control Center 620 Session Hijacking

Title: ====== Barracuda Control Center 620 - Multiple Web Vulnerabilities Date: ===== 2011-12-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=32 VL-ID: ===== 32 Introduction: ============= Barracuda Networks - Worldwide leader in email and Web security. Control Cente...

SpamTitan 5.08 Cross Site Scripting

Title: ====== SpamTitan v5.08 - Multiple Web Vulnerabilities Date: ===== 2011-12-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=91 VL-ID: ===== 91 Introduction: ============= SpamTitan Anti Spam is a complete software solution to email security offering protection...

ImageShack Service - Cross Site Scripting Vulnerability

Document Title: =============== ImageShack Service - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=352 Release Date: ============= 2011-12-21 Vulnerability Laboratory ID VL-ID: ==================================== 352...

SpamTitan 5.08 - Multiple Vulnerabilities

SpamTitan 5.08 - Multiple Vulnerabilities Title: ====== SpamTitan v5.08 - Multiple Web Vulnerabilities Date: ===== 2011-12-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=91 VL-ID: ===== 91 Introduction: ============= SpamTitan Anti Spam is a complete software soluti...

Barracuda Control Center 620 - Multiple Web Vulnerabilities

Document Title: =============== Barracuda Control Center 620 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=32 Release Date: ============= 2011-12-21 Vulnerability Laboratory ID VL-ID: ==================================== ...

SpamTitan 5.08 - Multiple Vulnerabilities

Title: ====== SpamTitan v5.08 - Multiple Web Vulnerabilities Date: ===== 2011-12-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=91 VL-ID: ===== 91 Introduction: ============= SpamTitan Anti Spam is a complete software solution to email security offering protection...

Barracuda Control Center 620 - Multiple Web Vulnerabilities

Title: ====== Barracuda Control Center 620 - Multiple Web Vulnerabilities Date: ===== 2011-12-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=32 VL-ID: ===== 32 Introduction: ============= Barracuda Networks - Worldwide leader in email and Web security. Control Cente...

ImageShack Service - Cross Site Scripting Vulnerability

Document Title: =============== ImageShack Service - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=352 Release Date: ============= 2011-12-21 Vulnerability Laboratory ID VL-ID: ==================================== 352...

Barracuda Control Center 620 - Multiple Web Vulnerabilities

Exploit for jsp platform in category web applications Introduction: ============= Barracuda Networks - Worldwide leader in email and Web security. Control Center Application of Barracuda Networks Copy of the Vendor Homepage: http://www.barracudanetworks.com/ns/products/ Abstract: =========...

WebSVN 'path' 参数跨站脚本漏洞

Bugtraq ID: 51109 WebSVN是一个基于Web的Subversion Repository浏览器。 通过"path"参数传递给comp.php或revision.php脚本的输入在返回用户之前svnlook.php脚本中的"getLog"函数对此缺少过滤，可被利用进行跨站脚本攻击。 构建恶意URL，诱使用户解析，可获得敏感信息或劫持用户会话 0 WebSVN 2.3.2 WebSVN 2.1 WebSVN 2.0rc4 WebSVN 2.0 WebSVN 1.7 WebSVN 1.0 厂商解决方案 WebSVN 2.3.1及之后版本已经修复此漏洞，建议用户下载使用：...

SpamTitan v5.08 - Multiple Web Vulnerabilities

Document Title: =============== SpamTitan v5.08 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=91 Release Date: ============= 2011-12-19 Vulnerability Laboratory ID VL-ID: ==================================== 91 Product &...

SpamTitan v5.08 - Multiple Web Vulnerabilities

Document Title: =============== SpamTitan v5.08 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=91 Release Date: ============= 2011-12-19 Vulnerability Laboratory ID VL-ID: ==================================== 91 Product &...

FBC Market v1.1 - Cross Site Scripting Vulnerability

Document Title: =============== FBC Market v1.1 - Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=364 Release Date: ============= 2011-12-19 Vulnerability Laboratory ID VL-ID: ==================================== 364...

Sina microblogging certified design flaws and fixes-vulnerability warning-the black bar safety net

Brief description: Sina Weibo design defects, resulting in know the original account password, even if the modified password can be obtained permission to publish Twitter, add attention like operation, 可以参考http://www.80sec.com/session-hijackin.html Describe: Sina microblogging authentication on t...

CVE-2011-4728

The CVE-2011-4728 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18, where the Server Administration Panel does not set the secure flag on a cookie during HTTPS sessions. This allows an attacker to capture the cookie by probing or intercepting traffic in an HTTP context, as demonstra...

Apache Struts会话篡改安全限制绕过漏洞

BUGTRAQ ID: 50940 Apache Struts是一款开发Java web应用程序的开源Web应用框架。 Apache Struts在实现上存在安全限制绕过漏洞，成功攻击可允许攻击者绕过安全限制获取非法访问权 Apache Struts 2.1.8 .1 Apache Struts 2.0.9 厂商补丁： Apache Group ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://httpd.apache.org/...

Serv-U FTP server security vulnerabilities

Resource exhaustion, administrative session hijacking...

WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities

---------------------------------------------------- WikkaWiki = 1.3.2 Multiple Security Vulnerabilities ---------------------------------------------------- author............: Egidio Romano aka EgiX mail..............: n0b0d13satgmaildotcom software link.....: http://wikkawiki.org/...

CodeIgniter 'CI_Security' Class 'xss_clean()'过滤器安全绕过漏洞

Bugtraq ID: 50847 CVE ID：CVE-2011-4025 CodeIgniter是一套给PHP网站开发者使用的应用程序开发框架和工具包 依赖xssclean过滤器进行XSS保护的EllisLab ExpressionEngine和CodeIgniter存在跨站脚本漏洞，允许攻击者进行会话劫持，信息泄露，安装恶意软件等攻击。 CISecurity类的removeevilattributes函数和xssclean实现存在缺陷，内部XSS过滤器可被绕过，允许在使用EllisLab ExpressionEngine和CodeIgniter产品上进行成功的XSS攻击。...