Oracle Application Express (Apex) CVE-2012-1708

An unspecified vulnerability in versions 4.0 and 4.1 of the Application Express Apex component of the Oracle Database Server allows remote attackers to affect integrity via unpublished vectors. --------------------------------------------------------------------------------- c Recx Ltd 2009-2012...

CVE-2012-4473

The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node type page" permission to access unpublished nodes via a direct request...

Server side request forgery (ssrf)

The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node type page" permission to access unpublished nodes via a direct request...

CVE-2012-4473

The CVE-2012-4473 vulnerability affects the Drupal contributed module Restrict node page view (7.x-1.x) prior to version 7.x-1.2. The underlying issue is that the module can grant access to unpublished nodes to remote authenticated users who have the permissions “view any node page” or “view any ...

CVE-2012-4473

The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node type page" permission to access unpublished nodes via a direct request...

Code injection

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page...

CVE-2012-1590

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page...

CVE-2012-1590

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page...

SA-CONTRIB-2012-093 - Node Embed - Access Bypass

Node Embed gives content editors an interface for selecting and embedding nodes using a WYSIWYG editor. The interface for selecting nodes is a page that had no access check, allowing users to view node titles they might not have access to. This issue only affects your site if you have unpublished...

RazorCMS <= 1.2.1 STABLE CSRF (Delete Web Pages)

Exploit for php platform in category web applications +------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : RazorCMS body onload="javascrip...

Unfixed XSS vulnerability at ahpi.math.cnrs.fr

Security researcher Atmon3r, has submitted on 14/01/2012 a cross-site-scripting XSS vulnerability affecting ahpi.math.cnrs.fr, which at the time of submission ranked 14215 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/01/2012. It is...

FreeBSD - 'ftpd / ProFTPd' Remote Command Execution

/ KCOPE2011 - x86/amd64 bsd ftpd remote root exploit KINGCOPE CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of KINGCOPE Security. C COPYRIGHT KINGCOPE Security, 2011 All Rights Reserved bug found by Kingcope thanks to noone except alex whose damn down tested against:...

Joomla! Component Techfolio 1.0 - SQL Injection

Techfolio 1.0 Component Joomla SQL Injection Release Date Bug. 27-Oct-2011 Date Added. 30-Sep-2011 Vendor Notification Date. Never Product. Techfolio Platform. Joomla Affected versions. 1.0 Type. Non-Commercial Attack Vector. Sql Injection Solution Status. unpublished CVE reference. Not yet...

Unfixed XSS vulnerability at lepetitmarocain.net

Security researcher YB, has submitted on 20/09/2011 a cross-site-scripting XSS vulnerability affecting lepetitmarocain.net, which at the time of submission ranked 1673192 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is current...

Unfixed XSS vulnerability at www.jesuspolice.com

Security researcher AR3SW0RMED, has submitted on 27/06/2011 a cross-site-scripting XSS vulnerability affecting www.jesuspolice.com, which at the time of submission ranked 2349652 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/12/2011. It is...

Unfixed XSS vulnerability at www.coffscoastadvocate.com.au

Security researcher Batch, has submitted on 05/07/2011 a cross-site-scripting XSS vulnerability affecting www.coffscoastadvocate.com.au, which at the time of submission ranked 586038 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/12/2011. I...

plone -- Remote Security Bypass

Plone developer reports: This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still ...

Google Urchin 5.7.03 Local File Inclusion

While fuzzing an Urchin web application, I discovered what appears to be an LFI vulnerability. Neither Secunia nor Google / Urchin appear to have reported this as a known issue. The problem lies in the gfid parameter passed to urchin.cgi. This was tested on a somewhat modified version of Urchin...

Unfixed XSS vulnerability at www.orland-press-register.com

Security researcher Devek, has submitted on 27/07/2010 a cross-site-scripting XSS vulnerability affecting www.orland-press-register.com, which at the time of submission ranked 1488652 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/12/2011. ...

Unfixed XSS vulnerability at www.nowplayingutah.com

Security researcher bho, has submitted on 13/07/2010 a cross-site-scripting XSS vulnerability affecting www.nowplayingutah.com, which at the time of submission ranked 720747 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is...