CVE-2010-5293

wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match...

vBulletin vBSEO 3.2.0 / 3.6.0 Cross Site Scripting

Exploit Title : Cross Site Scripting XSS - Stored vulnerability in vBulletin SEO Plugin vBSEO. Found By : Yogesh Jaygadkar | http://www.jaygadkar.com/ Tested versions : vBSEO 3.2.0 & vBSEO 3.6.0 Tested with : vBulletin 4.0.6 & vBulletin 4.2.1 Vulnerable POST Parameter : sendtrackbacks Greetz to :...

Serendipity comment.php url Parameter SQL Injection

The version of the Serendipity installed on the remote host is affected by a SQL injection vulnerability because the 'include/functionstrackbacks.inc.php' script does not properly sanitize user-supplied input passed via the 'url' parameter to the 'comment.php' script. Provided that PHP's...

Authentication flaw

GR Board aka grboard 1.8.6.5 Community Edition does not require authentication for certain database actions, which allows remote attackers to modify or delete data via a request to 1 modrewrite.php, 2 commentwriteok.php, 3 poll/index.php, 4 update/index.php, 5 trackback.php, or 6 an arbitrary...

myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique

myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique Software: myBloggie 2.1.6 Severity: High Author: Robin Verton info at robinverton dot de Date: Jun. 12 2011 Vendor: http://mybloggie.mywebland.com/ Software Description: "myBloggie is considered one of the most simple,...

myBloggie 2.1.6 SQL Injection

myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique Software: myBloggie 2.1.6 Severity: High Author: Robin Verton Date: Jun. 12 2011 Vendor: http://mybloggie.mywebland.com/ Software Description: "myBloggie is considered one of the most simple, user-friendliest yet packed with...

Wordpress Update Fixes Malicious Author Vulnerability

An update to the popular WordPress blogging platform fixes a known security hole that could have enabled a malicious contributor to gain wider control over the blog to which he or she contributed. WordPress 3.0.2 was posted on Tuesday. The privilege escalation hole was described as of “moderate”...

Cross site scripting

Cross-site scripting XSS vulnerability in the tb-send.rb TrackBack transmission plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the 1 plugintburl and 2 plugintbexcerpt parameters...

CVE-2010-0726

Cross-site scripting XSS vulnerability in the tb-send.rb TrackBack transmission plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the 1 plugintburl and 2 plugintbexcerpt parameters...

CVE-2010-0726

tDiary’s tb-send.rb TrackBack plugin (versions ≤ 2.2.2) is vulnerable to Cross-Site Scripting (XSS). Exploitation vectors are not fully disclosed in the provided docs, but the CVE-2010-0726 entry notes possible vectors related to plugin_tb_url and plugin_tb_excerpt. Debian reports the issue as an...

WordPress Trackback脚本拒绝服务漏洞

CVE ID: CVE-2009-3622 WordPress是一款免费的论坛Blog系统。 WordPress的wp-trackback.php脚本允许用户向mbconvertencoding函数提交多个源字符编码。如果远程攻击者在提交的HTTP请求中包含有超长的标题参数和由多个逗号分隔的UTF-8子字符串所组成的字符集参数，就可以占用大量CPU资源。 WordPress 2.8.5 厂商补丁： WordPress --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

DEBIAN-CVE-2009-3622

Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service CPU consumption and server hang via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related t...

WordPress Zaps Security Bugs in 'Hardening Release'

The WordPress blog software has been upgraded to version 2.8.5 to backport a number of security hardening changes to make WordPress-powered blogs more secure. Here’s a glimpse of some of the security fixes being pushed out: A fix for the Trackback Denial-of-Service attack that is currently being...

Loggix Project <= 9.4.5 Multiple Remote File Include Vulnerability

No description provided by source. In The Name Of Allah Loggix Project = 9.4.5 Multiple Remote File Include Vulnerability Download Script : http://sourceforge.net/projects/loggix/files/ Author : cr4wl3r Contact : cr4wl3r4tlinuxmaildotorg Location : Gorontalo - INDONESIA Blog :...

Loggix Project 9.4.5 - Multiple Remote File Inclusions

Loggix Project 9.4.5 - Multiple Remote File Inclusions In The Name Of Allah Loggix Project = 9.4.5 Multiple Remote File Include Vulnerability Download Script : http://sourceforge.net/projects/loggix/files/ Author : cr4wl3r Contact : cr4wl3r4tlinuxmaildotorg Location : Gorontalo - INDONESIA Blog :...

Loggix Project 9.4.5 Remote File Inclusion

In The Name Of Allah Loggix Project = 9.4.5 Multiple Remote File Include Vulnerability Download Script : http://sourceforge.net/projects/loggix/files/ Author : cr4wl3r Contact : cr4wl3r4tlinuxmaildotorg Location : Gorontalo - INDONESIA Blog : http://sh3ll4u.blogspot.com Dork : No DoRk f0R ScRipT...

CVE-2008-5845

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...

CVE-2008-5845

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...

CVE-2008-5845

Multiple cross-site scripting XSS vulnerabilities in Six Apart Movable Type MT before 4.23 allow remote attackers to inject arbitrary web script or HTML via a 1 MTEntryAuthorUsername, 2 MTAuthorDisplayName, 3 MTEntryAuthorDisplayName, or 4 MTCommenterName field in a Profile View template; a 5...