Fast Secure 3.0.3.1 Cross Site Scripting

Vulnerability ID: HTB23036 Reference: http://www.htbridge.ch/advisory/xssinfastsecurecontactform.html Product: Fast Secure Contact Form wordpress plugin Vendor: Mike Challis http://www.fastsecurecontactform.com Vulnerable Version: 3.0.3.1 and probably prior Tested on: 3.0.3.1 Vendor Notification:...

threedify designer 5.0.2 - Multiple Vulnerabilities

threedify designer 5.0.2 - Multiple Vulnerabilities ========================================= Vulnerability ID: HTB23021 Reference: http://www.htbridge.ch/advisory/threedifydesigneractivexcontrolinsecuremethod.html Product: ThreeDify Designer Vendor: ThreeDify http://www.threedify.com Vulnerable...

ThreeDify Designer ActiveX control Insecure Method

Vulnerability ID: HTB23021 Reference: http://www.htbridge.ch/advisory/threedifydesigneractivexcontrolinsecuremethod.html Product: ThreeDify Designer Vendor: ThreeDify http://www.threedify.com Vulnerable Version: 5.0.2 and probably prior Tested on: 5.0.2 Vendor Notification: 07 June 2011...

XSS in WP e-Commerce

Vulnerability ID: HTB23031 Reference: http://www.htbridge.ch/advisory/xssinwpecommerce.html Product: WP e-Commerce Vendor: Instinct Entertainment http://getshopped.org/ Vulnerable Version: 3.8.5 and probably prior Tested on: 3.8.5 Vendor Notification: 13 July 2011 Vulnerability Type: XSS Cross Si...

WordPress e-Commerce 3.8.5 Cross Site Scripting

Vulnerability ID: HTB23031 Reference: http://www.htbridge.ch/advisory/xssinwpecommerce.html Product: WP e-Commerce Vendor: Instinct Entertainment http://getshopped.org/ Vulnerable Version: 3.8.5 and probably prior Tested on: 3.8.5 Vendor Notification: 13 July 2011 Vulnerability Type: XSS Cross Si...

Multiple XSS in HESK

Vulnerability ID: HTB23030 Reference: http://www.htbridge.ch/advisory/multiplexssinhesk.html Product: HESK Vendor: Klemen Stirn http://www.hesk.com/ Vulnerable Version: 2.2 and probably prior Tested on: 2.2 Vendor Notification: 06 July 2011 Vulnerability Type: XSS Cross Site Scripting Risk level:...

THN Review : Ghost in the Wires - Kevin Mitnick

THN Review : Ghost in the Wires - Kevin Mitnick First of all Thanks to Mr. Kevin Mitnick for sending Review Copy of his latest book & Auto-Biography "Ghost in the Wires - My Adventures As The World's Most Wanted Hacker". I take about a week to read this amazing book and Finally The Hacker News...

XSS in Tiki Wiki CMS Groupware

Vulnerability ID: HTB23027 Reference: http://www.htbridge.ch/advisory/xssintikiwikicmsgroupware.html Product: Tiki Wiki CMS Groupware Vendor: info.tiki.org http://info.tiki.org Vulnerable Version: 7.0 and probably prior Tested on: 7.0 Vendor Notification: 29 June 2011 Vulnerability Type: XSS Cros...

Asprain forum for registered users to upload pictures you can get a webshell-vulnerability warning-the black bar safety net

Asprain is a suitable for all primary and secondary schools, secondary school, technical school, vocational high-building campus Forum, students Forum, some teaching and research departments, companies build internal Forum, IT technology enthusiasts building technology exchange Forum Free Forum...

SQL injection in Social Slider

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Social Slider, which can be exploited to perform SQL injection attacks. 1 SQL Injection Vulnerability in Social Slider Input passed via the "rA" POST parameter to /wp-content/plugins/social-slider-2/ajax.php is not properly...

Tech-ex CMS website system 0day releases-vulnerability warning-the black bar safety net

Keywords: Powered By KesionCMS V5. 5 inurl:User/UserReg. asp Step one: access to/user/userreg. asp registered user Step two: access/KSeditor/selectupfiles. asp, check the auto-naming options, upload named as X. asp;X. jpg files Step three: access the Upload file path xm. asp;xm.jpg...

Cross-site Scripting (XSS) Vulnerabilities in GBook PHP guestbook

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in GBook PHP guestbook which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerabilities in GBook PHP guestbook The vulnerability exists due to input sanitation error in th...

a-Tech SQL Injection

+Title : a-Tech Sql Injection vulnerability +Vender : http://www.a-Tech.pl +Auther : Bl4ck.Viper Turkish Hacker +Email : [email protected] +Date : 04/07/2011 +Home : www.skote-vahshat.com +MyArchive : www.xpl.skote-vahshat.com Err0r 0n : product.php Exploit :...

Ashampoo 3D CAD Professional 3 ActiveX control Insecure Method

Vulnerability ID: HTB23019 Reference: http://www.htbridge.ch/advisory/ashampoo3dcadprofessional3activexcontrolinsecuremethod.html Product: Ashampoo 3D CAD Professional 3 Vendor: Ashampoo GmbH Co http://www.ashampoo.com Vulnerable Version: 3.0.1 and probably prior Tested on: 3.0.1 Vendor...

Free Simple CMS 1.0 Cross Site Scripting / Local File Inclusion

Vulnerability ID: HTB23010 Reference: http://www.htbridge.ch/advisory/multiplexssinfreesimplecms.html Product: Free Simple CMS Vendor: Dustin Cowell Enterprises http://www.freesimplesoft.com/ Vulnerable Version: 1.0 and probably prior Tested on: 1.0 Vendor Notification: 25 May 2011 Vulnerability...

PBX Phone System v2.x & 3.x - Multiple Web Vulnerabilities

Document Title: =============== PBX Phone System v2.x & 3.x - Multiple Web Vulnerabilities References Source: ==================== CVE: 2009-4458 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4458 OSVDB-ID: 61357 http://osvdb.org/show/osvdb/61357 EDB-ID: 10645...

Free Simple CMS 1.0 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: Free Simple CMS Vendor: Dustin Cowell Enterprises http://www.freesimplesoft.com/ Vulnerable Version: 1.0 and probably prior Tested on: 1.0 Vendor Notification: 25 May 2011 Vulnerability Type: XSS Cross Site Scripting, Local File...

Insecure Method in aTube Catcher ActiveX Control

High-Tech Bridge SA Security Research Lab has discovered vulnerability in aTube Catcher ActiveX Control which could be exploited to perform denial of service attacks. 1 Insecure method in aTube Catcher ActiveX Control The vulnerability exists due to existence of insecure method SaveDecrypted in t...

Cross-site Scripting (XSS) Vulnerability in FanUpdate

High-Tech Bridge SA Security Research Lab has discovered vulnerability in FanUpdate which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in FanUpdate The vulnerability exists due to input sanitation error in the "pageTitle" parameter in...

A Really Simple Chat (ARSC) 3.3-rc2 XSS / SQL Injection

============================== Vulnerability ID: HTB22999 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectionsinareallysimplechatarsc.html Product: A Really Simple Chat ARSC Vendor: http://www.reallysimplechat.org/ http://www.reallysimplechat.org/ Vulnerable Version: 3.3-rc2 Vendor...