OpenDocMan 1.2.7.2 Cross Site Scripting

Exploit Title: Stored Cross Site Scripting Vulnerability leads to hijack the users session Date: 2 July 2014 Exploit Author: Madhu Akula Vendor Homepage: http://www.opendocman.com/ Version : 1.2.7.2 Severity: High Description : About Vulnerability : Stored attacks are those where the injected...

Lotus Domino IMAP4 Server 6.5.4 - Remote Buffer Overflow Exploit

No description provided by source. Lotus Domino IMAP4 Server Release 6.5.4 / Windows 2000 Advanced Server x86 Remote Exploit Vulnerable: IBM Lotus Domino = 7.0.2 && 6.5.5 FP2 tested 6.5.4 Authors: Dominic Chell [email protected] & prdelka Exploitation steps: 1 The instruction call dword e...

McAfee Superscan 4.0 - XSS Vulnerability

No description provided by source. Trustwave SpiderLabs Security Advisory TWSL2013-024: Cross Site Scripting XSS vulnerability in McAfee Superscan 4.0 Published: 08/02/2013 Version: 1.0 Vendor: McAfee http://www.mcafee.com/ Product: SuperScan Version affected: v4.0 Product description: SuperScan ...

phpslash <= 0.8.1.1 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q ?php phpslash = 0.8.1.1 Remote Code Execution Exploit - - - - - - - - - - - - - - - - - - - - - - - - - RCE with no special rights guest. No special PHP conditions required. - - - - - - - - - - - - - - - - - - - - - - - - - 0 It was a private...

ViewGit 0.0.6 - Multiple XSS Vulnerabilities

No description provided by source. Vulnerability Report Author: Matthew R. Bucci [email protected] Date: 18 March, 2013 CVE-2013-2294 Description of Vulnerability: ----------------------------- ViewGit is a git web repository viewer that aims to be easy to set up and upgrade, light on...

Camtron CMNC-200 IP Camera Directory Traversal Vulnerability

No description provided by source. Finding 2: Directory Traversal in Camera Web Server CVE: CVE-2010-4231 The CMNC-200 IP Camera has a built-in web server that is enabled by default. The server is vulnerable to directory transversal attacks, allowing access to any file on the camera file system...

Camtron CMNC-200 IP Camera Undocumented Default Accounts

No description provided by source. Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be normally disabled. The...

Coppermine Photo Gallery <= 1.4.14 picEditor.php Command Execution

No description provided by source. $Id: copperminepiceditor.rb 9671 2010-07-03 06:21:31Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms...

Camtron CMNC-200 IP Camera Authentication Bypass

No description provided by source. Finding 3: Web Based Administration Interface Bypass CVE: CVE-2010-4232 The CMNC-200 IP Camera has an administrative web interface that does not handle authentication properly. Using a properly formatted request, an attacker can bypass the authentication...

Webkit (Apple Safari < 4.1.2/5.0.2 & Google Chrome < 5.0.375.125) - Memory Corruption

No description provided by source. TITLE: WEBKIT APPLE SAFARI 4.1.2/5.0.2 & GOOGLE CHROME 5.0.375.125 MEMORY CORRUPTION VULNERABILITY TESTED OS: WINDOWS XP SP3 SEVERITY: HIGH CVE-NUMBER: CVE-2010-1813 DISCOVERED DATE: 2010-06-29 FIXED DATE: GOOGLE CHROME 2010-07-26 & APPLE SAFARI 2010-09-08 FIXED...

Mail.ru: Cross Site Scripting

Hi Team , Have found a bug in your main domain ".mail.ru" Vulnerable URL: http://deti.mail.ru/mama/ Vulnerable Parameter: Display text , URL links Payload:"/ Steps to Reproduce: 1.Go to the vulnerable link. 2.Click on "Share experiences" , this will open a form. 3.Click on "Insert Link" , give th...

X (Formerly Twitter): XSS ON MOPUB.COM

PERSITENT XSS ON MOPUB.COM STEPS TO REPRODUCE: 1. go to order 2. type in the advertiser " and then press tab 3. PAYLOAD RUNS...

Automattic: XSS on gravatar

Hello team of Wordpress! I am Simone and I am here to report a XSS on gravatar! I think that you don't believe me, but it's true, because I have found 171 XSS with different directory and parametrers! Let's the details: Vulnerability:XSS. Severity:High. Vulnerability description: Cross site...

SNMP Reflection DDoS Attacks on the Rise

The DDoS techniques have massively increased with the attackers becoming more skillful at working around the network security. A massive 300Gbps DDoS attack launched against Spamhaus website almost broke the Internet a year ago and also earlier this year, hackers have succeeded in reaching new...

Protection strategies for the Security Advisory 2963983 IE 0day

We’ve received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay...

AOL Breached, Investigating Spam from Spoofed Accounts

AOL reported today that it has been breached and urges users of its web-based email and other online services to change their passwords. AOL’s investigation of a breach of its internal network and systems is under way with the help of federal authorities and a forensics firm, the company said. La...

Localize: Business logic Failure - Browser cache management and logout vulnerability.

Vulnerability class: Business logic Failure - Browser cache management and logout vulnerability. Vulnerability impact: Logging out from an application does not clear the browser cache of any sensitive information that have been stored. Steps to reproduce: 1. Login to portal. 2.browse few tabs 3...

[SECURITY] Fedora 19 Update: mantis-1.2.17-1.fc19

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis-1.2.17...

WordPress Buddypress 1.9.1 Cross Site Scripting

Vulnerability: Wordpress plugin Buddypress = 1.9.1 stored xss Date: 13/02/2014 Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip Version: 1.9.1 CVE : CVE-2014-1888 Responsibly disclosed and patched in version 1.9....

Tableau Server Blind SQL Injection

Trustwave's SpiderLabs Security Advisory TWSL2014-003: Blind SQL Injection Vulnerability in Tableau Server Published: 02/07/14 Version: 1.1 Vendor: Tableau Software http://www.tableausoftware.com Product: Tableau Server Versions affected: 8.1.X before 8.1.2 and 8.0.X before 8.0.7. Not present in...