Directory traversal

Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possibility of disclosing information about the remote host...

CVE-2017-1000448

CVE-2017-1000448 affects Structured Data Linter, versions 2.4.1 and older. The root cause is a directory traversal vulnerability in the URL input field, which can disclose information about the remote host. Public documentation in the provided sources confirms the vulnerability and affected versi...

CVE-2017-1000448

Structured Data Linter versions 2.4.1 and older are vulnerable to a directory traversal attack in the URL input field resulting in the possibility of disclosing information about the remote host...

Open Redirect

phpBB is vulnerable to open redirects. The library does not properly check user input URLs, allowing a malicious user to redirect users using the Google Chrome Browser to a malicious website...

USN-3275-1 openjdk-8 vulnerabilities

It was discovered that OpenJDK improperly re-used cached NTLM connections in some situations. A remote attacker could possibly use this to cause a Java application to perform actions with the credentials of a different user. CVE-2017-3509 It was discovered that an untrusted library search path fl...

Radancy: XSS

https://werkenbijdefensie.nl/vacatures/kla03vc%3cimg%20src%3da%20onerror%3dalert1%3ehm505/bouw/ The value of the URL path folder 2 is copied into the HTML document as plain text between tags. The payload a03vchm505 was submitted in the URL path folder 2. This input was echoed unmodified in the...

HackerOne: IE 11 Self-XSS on Jira Integration Preview Base Link

I wasn't sure if you would accept this report due to it being Self-XSS, but I figured it might be useful information because it breaks one of the flows used to validate URLs. Steps ==================== 1. Launch IE 11 2. Log into a HackerOne account that has admin on a program. 3. Go to the...

Kodi Local File Inclusion Vulnerability

Kodi formerly XBMC is a free and open source media player software application developed by the XBMC Foundation.Chorus is the web interface used to control and interact with Kodi. Kodi suffers from a local file inclusion vulnerability that stems from insufficient validation of user input performe...

Switch 4.68 Code Execution

Document Title: =============== Switch v4.68 - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1649 Release Date: ============= 2015-11-23 Vulnerability Laboratory ID VL-ID: ==================================== 1649 Common...

FHFS - FTPHTTP File Server 2.1.2 Remote Command Execution

FHFS - FTPHTTP File Server 2.1.2 Remote Command Execution !/usr/bin/python FHFS - FTP/HTTP File Server 2.1.2 Remote Command Execution Author: Naser Farhadi Date: 26 August 2015 Version: 2.1.2 Tested on: Windows 7 SP1 32 bit Link : http://sourceforge.net/projects/fhfs/ Description : FHFS is a FTP...

SupportEzzy Ticket System WordPress Plugin Stored XSS Vulnerability

SupportEzzy is an elegant support tickets system and faqs portal for WordPress. This is a stand-alone AngularJS app which runs on a single WordPress page of your website. This app does not interfere with your existing theme and plugins and will work with any kind of WordPress website. You can use...

Cart Engine 3.0 XSS / Open Redirect / SQL Injection

=== Details === Quantum Leap Advisory: http://www.quantumleap.it/cart-engine-3-0-multiple-vulnerabilities-sql-injection-reflected-xss-open-redirect/ Affected Product: Cart Engine Version: 3.0 === Executive Summary === SQL Injection: Using a specially crafted HTTP request, it is possible to exploi...

ibProArcade <= 3.3.0 - Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl ibProArcade = v3.3.0 sql injection exploit coded by 1dt.w0lf RST/GHC THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; BEGIN if$^O eq 'MSWin32' require Win32::Console;...

XML-Sitemaps.com Sitemap Generator 6.0 Cross Site Scripting

XML-Sitemaps.com Sitemap Generator Date: 2nd July 2013 Author: Christy Philip Mathew www.offcon.org Vendor or Software Link: http://www.xml-sitemaps.com/generator-demo/ Version : 6.0 XSS Vulnerability a Configuration Miscellaneous Settings Send email notifications: Update the email to [email protected]" b...

CVE-2013-3383

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4, aka Bug ID CSCzv69294...

Twister Peer-To-Peer Microblogging Information Disclosure

======================================================================== TWISTER Peer-To-Peer microblogging Multiples Application Error Message and disclosing sensitive information ======================================================================== TIME-LINE VULNERABILITY Multiples Advisorie...

WebEmlak Real Estate Cross Site Scripting

Exploit Title: WebEmlak Real Estate Script Stored XSS Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Cross Site Scripting can be done using the URL input Vulnerable Page: index.php Example: index.php/ Exploit:...

RealPlayer: URL unescape buffer overflow

Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a URL argument containing a % percent...

Debian Security Advisory DSA 1560-1 (kronolith2)

The remote host is missing an update to kronolith2 announced via advisory DSA 1560-1. OpenVAS Vulnerability Test $Id: deb15601.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1560-1 kronolith2 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Picture Rating 1.0 Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl -- Picture Rating 1.0 Blind SQL Injection Exploit -- -Info/Instructions- After running this perl script, you will have admin details therefore you will be able to login to the admin area at http://site.com/control/ ok once you have logged in has...