Joomla! Component com_hdflvplayer 2.1.0.1 - SQL Injection

Joomla! Component comhdflvplayer 2.1.0.1 - SQL Injection !/usr/bin/python Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link : http://www.hdflvplayer.net/downloadcount.php?pid=5 Dork google 1:...

phpMyFAQ 2.8.x - Multiple Vulnerabilities

Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user session in 'Statistic' tab. Over...

MemHT Portal 4.0.1 [user agent] Persistent Cross Site Scripting

No description provided by source. !/usr/bin/perl MemHT Portal 4.0.1 Persistent Cross Site Scripting Vulnerability user agent by ZonTa - zontahackersatgmaildotcom After successful inject wait for the admin to view statistic page. Fix is available :...

AIX 4.2/4.3 netstat -Z Statistic Clearing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1660/info A vulnerability exists in versions 4.x. x of AIX, from IBM. Any local user can utilize the -Z command to netstat, without needing to be root. This will cause interface statistics to be reset. This could...

XSS on several select lists

Steps to reproduce: -Create a new issue type -Add "alert'Issue name' as Issue name mind the qoute at the beginning -Add "alert'Issue desc' as Issue Description -Add /images/icons/issuetypes/genericissue.png "alert'Issue icon' as Issue Icon -Make sure that this issue type is available on your...

Persistent XSS in JIRA charting plugin Workload Pie Chart Report

The Workload Pie Chart Report included with the JIRA charting plugin contains a number of XSS vulnerabilities. This plugin is bundled with OnDemand. The configuration page contains an XSS vulnerability in custom field names. 1. Create a custom field with the name alert'custom field' 2. Try to...

Ad Manager Pro v. 4 Remote FLI

-=--------------------ADVISORY-------------------=- Ad Manager Pro v. 4 Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Ad Manager Pro -=+ Version: 4 -=+ Vendor's URL: http://www.phpwebscripts.com/ad-manager-pro/ -=+...

Sql injection

SQL injection vulnerability in the FE user statistic festat extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2010-4952

The CVE-2010-4952 issue affects the TYPO3 FE user statistics extension festat, vulnerable in versions before 0.2.4 due to an SQL injection flaw that allows remote attackers to execute arbitrary SQL via unspecified vectors. The vulnerability can impact confidentiality, integrity, and availability ...

lansuite-lfi.txt

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl lansuite success $stats = new stats; // Boxes if !$IsAboutToInstall and !$GET'contentonly' and $GET'design' != 'base'...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tmincludepath parameter to 1 Classes.inc.php, 2 statistic.inc.php, 3 status.inc.php, 4 statustopx.inc.php, or 5 libchart-1.1/libchart.php in include/. NOTE:...

Sysstat不安全临时文件建立漏洞

Sysstat是一款Linux下的系统统计工具。 Sysstat不正确处理/tmp/sysstat.run脚本，本地攻击者可以利用漏洞进行拒绝服务攻击。 通过符号链接，可导致破坏系统敏感文件造成拒绝服务攻击。 Sysstat Sysstat 7.1.6 Gentoo Linux 可参考如下安全公告获得补丁信息： https://bugs.gentoo.org/showbug.cgi?id=188808...

AllWeb search SQL inj. vuln.

AllWeb search SQL inj. vuln. Vuln. dicovered by : r0t Date: 28 nov. 2005 orginal advisory:http://pridels.blogspot.com/2005/11/allweb-search-sql-inj-vuln.html Vendor:http://www.scripts-templates.com affected version: 3.0 and prior Product Description: Want to make money from your site traffic?...