WordPress MoodThingy Widget v0.8.7 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link:...

WordPress Plugin MoodThingy Widget 0.8.7 - Blind SQL Injection

Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link: http://downloads.wordpress.org/plugin/moodthingy-mood-rating-widget.0.8.7.zip Version: 0.8.7 =====================...

CVE-2012-1661 - ESRI ArcMap arbitrary code execution via crafted map file.

Description: Opening a specially crafted mxd file will execute arbitrary code without prompting and without a crash of the application. This is due to a flaw in the programs ability to prompt a user before executing embedded VBA. Mxd files are not filtered by email systems so this allows a remote...

PHP 5.3.x < 5.3.14 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.14, and is, therefore, potentially affected the following vulnerabilities : - An integer overflow error exists in the function 'pharparsetarfile' in the file 'ext/phar/tar.c'. This error can lead to...

Perl DBD-Pg Module: Arbitrary code execution

Background DBD-Pg is a PostgreSQL interface module for Perl. Description Format string vulnerabilities have been found in the the "pgwarn" and "dbdstprepare" functions in dbdimp.c. Impact A remote PostgreSQL server could send specially crafted database warnings or DBD statements, possibly resulti...

CVE-2012-0709

IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements...

Kingdee Apusic Web framework for the backend to get the site webshell and repair-vulnerability warning-the black bar safety net

Apusic Web Management Console Default background address: admin/login. jsp The default management account password: admin admin Use method: the background has to execute SQL statements, also have to load anything. Specific words have forgotten Find Upload, a loaded God horse, just look to...

MySQL < 5.5.6 Multiple Denial of Service

The version of MySQL installed on the remote host is older than 5.5.6. As such, it reportedly is prone to multiple denial of service attacks : - The improper handling of type errors during argument evaluation in extreme-value functions, e.g., 'LEAST' or 'GREATEST' causes server crashes...

Researcher Releases New Version of P0f Fingerprinting Tool

Security researcher Michal Zalewski has released a new version of a passive fingerprinting tool called P0f that has the ability to diagnose a wide range of components in an Internet connection, even uncovering clients that are trying to forge some part of their identity in the connection. P0f is ...

AlstraSoft EPay Enterprise 4.0 SQL Injection

Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0 Tested on: Apache/1.3.37 An attacker may execute arbitra...

CA Total Defense Suite - reGenerateReports Stored procedure SQL Injection (Metasploit)

$Id: catotaldefenseregeneratereports.rb 13810 2011-10-02 17:03:23Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Mozilla Thunderbird < 9.0 Multiple Vulnerabilities (deprecated)

Binary data 6110.prm...

Asterisk2Billing v1.9.4 - SQL Injection Vulnerability

Document Title: =============== Asterisk2Billing v1.9.4 - SQL Injection Vulnerability Release Date: ============= 2011-08-11 Vulnerability Laboratory ID VL-ID: ==================================== 246 Product & Service Introduction: =============================== Asterisk ist eine freie Software...

Input validation

jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0; JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3.0, 4.3.0.CP09, and 5.1.1; and JBoss Enterprise Web Platform 5.1.1, does not properly...

ITROM Cart v1.0.x - SQL Injection Vulnerability

Document Title: =============== ITROM Cart v1.0.x - SQL Injection Vulnerability Release Date: ============= 2011-06-15 Vulnerability Laboratory ID VL-ID: ==================================== 114 Product & Service Introduction: =============================== It is a full featured, customizable, w...

MySQL Community Server 5.1 < 5.1.52 Multiple Denial of Service Vulnerabilities

Binary data 801123.prm...

CVE-2011-1846

CVE-2011-1846 affects IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux/UNIX/Windows. The vulnerability arises from failure to properly revoke role membership from groups, allowing remote authenticated users to execute non-DDL statements by leveraging previously inherited possession of a role. T...

Sql injection

Ecava IntegraXor HMI before n 3.60 Build 4032 allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection, but this might not be accurate...

HBA Crew (german carder forum) get hacked !

Now it's official: HBA-crew v2, was hacked! Ip 'were logged, Database is public! An official statement is as early as the first April before. But was it so funny but not that it was serious: Hi, Now we can not hide it anymore. geloaded Since yesterday evening by a leak in the server the entire...

CVE-2011-0330

The Dell DellSystemLite.Scanner ActiveX control in DellSystemLite.ocx 1.0.0.0 does not properly restrict the values of the WMIAttributesOfInterest property, which allows remote attackers to execute arbitrary WMI Query Language WQL statements via a crafted value, as demonstrated by a value that...