CVE-2017-16152: Improper Limitation of a Pathname to a Restricted Directory

static-html-server is a static file server. static-html-server is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

UBUNTU-CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

Webutler CMS 3.2 Cross Site Request Forgery

Exploit Title: Webutler CMS Cross-Site Request Forgery Date: 18 April 2016 Exploit Author: Keerati T. Post Vendor Homepage: http://webutler.de/en Software Link: http://webutler.de/download/webutlerv3.2.zip Version: 3.2 Tested on: Linux 1.Description The Webutler is a simple online page editor for...

Webutler CMS 3.2 - Cross-Site Request Forgery

Webutler CMS 3.2 - Cross-Site Request Forgery Dear OffSec, Here is the vulnerability detail as I submitted Exploit Title: Webutler CMS Cross-Site Request Forgery Date: 18 April 2016 Exploit Author: Keerati T. Post Vendor Homepage: http://webutler.de/en Software Link:...

BBSGood Forum program moprepost. asp variable HTTP_X_FORWARDED_FOR injection vulnerability-vulnerability warning-the black bar safety net

BBSGOOD is domestic first using the cache technology Forum, BBSGOOD posts and list home can generate a static HTML file. In the file moprepost. asp: if Request. ServerVariables"HTTPXFORWARDEDFOR"="" then ipdress=Request. ServerVariables"REMOTEADDR" else ipdress=Request...

BBSGood Forum program indexlabel. asp and labelsave. the asp page has SQL injection vulnerability-vulnerability warning-the black bar safety net

BBSGOOD is domestic first using the cache technology Forum, BBSGOOD posts and list home can generate a static HTML file. Vulnerability analysis: In the file indexlabel. asp: sql="select top 1 Admin,UserName,Password from BBSGoodAdmin where UserName='"&Request. Cookiesbbsinfo&"adminuser"&"' "...

BBSGood Forum program multi-page SQL injection vulnerability-vulnerability warning-the black bar safety net

BBSGOOD is domestic first using the cache technology Forum, BBSGOOD posts and list home can generate a static HTML file. 1. In the file DelShortInFo. asp: selectid=trimRequestCStringSafeRequest"selectid" //the 1 Line 1 If selectid"" then selectid = replaceselectid, ", ", " or ID=" selectid="Where...

phpArticle2.06本地包含文件漏洞

phpArticle是一个新闻发布系统，最近我学习php有了一段时间，在找网上的代码研究学习的时候，看了看， 发现了phpArticle2.06版本里有本地文件包含漏洞，因为找不到最新的phpArticle3下载，就没有测试。（刚又找了下，网上能下的最新的2.1版本也有此漏洞） 漏洞所在文件是countbbs.php里 代码里对提交的sys变量没做检查，就直接包含为admin/loadsystem/目录下的一个文件了， 所以我们可以提交自己构造的sys变量，使countbbs.php包含我们想包含的文件，但是由于变量...

Hot Links SQL 3.x XSS vuln.

Hot Links SQL 3.x XSS vuln. Vuln. dicovered by : r0t Date: 5 dec. 2005 Orginal advisory:http://pridels.blogspot.com/2005/12/hot-links-sql-3x-xss-vuln.html vendor:http://www.mrcgiguy.com/hlsqldetails.shtml affected version:3.1.x and prior Product Description: irectory style index allows for easy...