PT-2011-3239 · Microsoft +1 · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.16.4 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an uploaded file with a dangerous extension, such as .html, when accessed with a specific quer...

CVE-2011-1587

MediaWiki vulnerable component: web application logic handling file uploads and URI parsing. CVE-2011-1587 is a cross-site scripting (XSS) flaw affecting MediaWiki prior to 1.16.4, triggered when Internet Explorer 6 or earlier is used and a file with a dangerous extension (e.g., .html) is accesse...

CVE-2011-1578

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with...

Rightnow's => Auth Bypass Vulnerability (Shell Upload)

Exploit for php platform in category web applications My + Author : KaCaK Contact : email protected HomePage : http://secureb0x.blogspot.com , http://griadamlar.com Greetz : KnockOut , Mus4llat , Technical and All My Friends Software info |Web App. : Madni Designers Web Portal |Price : Price...

SSN Uploaded By A User via FTP

Binary data 5913.prm...

PYSEC-2011-31

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

MultiPowUpload 2.1 Shell Upload

Exploit Title: MultiPowUpload v 2.1 Remote File Upload Vulnerability Author: DIES3L Email: [email protected] Date: 26-1-2011 Software Link: http://www.element-it.com Download Software : http://www.element-it.com/Download/ElementIT.MultiPowUpload3.zip Version: 2.1 Tested on: LiNuX...

SOOP Portal 2.0 - Arbitrary File Upload

SOOP Portal 2.0 - Arbitrary File Upload I N F O Exploit Title: SOOP Portal 2.0 Remote Upload Shell Vulnerability DDate: 05-12-2010 Author: Net.Edit0r Software Link: www.soopportal.com Version: 2.0 Tested on: windows server 2008 Contact: [email protected] [email protected] E X P L O I T 1...

MetInfo 3.0 - 'FCKeditor' Arbitrary File Upload

Exploit Title: MetInfo 3.0 fckeditor File Upload Exploit Date: 02-11-2010 Author: sh3n Software Link: http://www.metinfo.cn/upload/file/metinfo3.0.zip Version: 3.0 Tested on: BT4 Ubuntu, Windows 7 Ultimate Exploit: metinfo.pe/fckeditor/editor/filemanager/connectors/uploadtest.html...

Krojac CMS SQL Injection

Exploit Title: Krojach CMS SQL Injection Vulnerabilities Date found: 6.2010 Author: MikiSoft Email: [email protected] CMS Software Site/Link: http://www.krojac.com Versions affected: All Edit: In latest version this is fixed now... Google dorks: intext:"Skrojio i sašio Krojač" ; intext:"Made...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

gpEasy 1.6.1 Cross Site Request Forgery

============================================= gpEasy Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/ Version: 1.6.1...

CVE-2009-2914

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Sql injection

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

jar: scheme ignores the content-disposition: header on the inner URI

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly other attacks via an uploaded .jar file with a...