HackerOne: Content Spoofing - External Link Warning Page

Here is example link: Click Here Raw Data: Click Here Issue: In External link warning page, this link shown as plain text and no forced URL encoded, leading an attacker to frame sentences and trick users. In given example, attacker can trick user to click 'Proceed' button saying it will redirect...

Linksys系列未明远程代码执行漏洞

No description provided by source. !/usr/bin/php ?php / Exploit for 0day linksys unauthenticated remote code execution vulnerability. As exploited by TheMoon worm; Discovered in the wild on Feb 13, 2013 by Johannes Ullrich. I was hoping this would stay under-wraps until a firmware patch could be...

Dolibarr 3.1.0 RC Cross Site Scripting / SQL Injection

Vulnerability ID: HTB23056 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesindolibarr.html Product: Dolibarr Vendor: Dolibarr foundation http://www.dolibarr.org/ Vulnerable Version: 3.1.0 RC and probably prior Tested Version: 3.1.0 RC Vendor Notification: 02 November 2011...

TYPO3 < 4.0.12/4.1.10/4.2.6 (jumpUrl) Remote File Disclosure Exploit

No description provided by source. !/usr/bin/env python ------------------------------------------------------------------------------ TYPO3-SA-2009-002 exploit by Lolek of TK53 [email protected] date: 2009/02/10 vendor url: http://typo3.org vulnerable versions: TYPO3 4.2.6, TYPO3 4.1.10, TYPO3...

CVE-2008-4166

Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a denial of service application crash by attempting to URL encode a string containing many instances of an invalid character...

CVE-2008-4166

Integer overflow in the JavaScript engine in Avant Browser 11.7 Build 9 and earlier allows remote attackers to cause a denial of service application crash by attempting to URL encode a string containing many instances of an invalid character...

Debian DSA-1403-1 : phpmyadmin - missing input sanitising

Omer Singer of the DigiTrust Group discovered several vulnerabilities in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5589 phpMyAdmin allows a remote attacker to inject arbitrary web...

CVE-2007-5386

Cross-site scripting XSS vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2007-5386

CVE-2007-5386 : XSS in phpMyAdmin 2.11.1’s scripts/setup.php when a browser does not URL-encode requests, allowing remote injection of arbitrary script/HTML via the query string. OpenVAS entries (Fedora/Debian updates) confirm a publicly known vulnerability and list CVSS base 4.3 (I:P), with nota...

AWStats <= 6.5 (migrate) Remote Shell Command Injection Exploit

No description provided by source. !/usr/bin/env python http://secunia.com/advisories/19969/ by [email protected] May 5, 2006 - HAPPY CINCO DE MAYO HAPPY BIRTHDAY DAD private plz redsand@jinxy / $ nc -l -p 31337 -v listening on any 31337 ... connect to 65.99.197.147 from blacksecurity.org...

My Gaming Ladder Combo System <= 7.0 Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl Method found & Exploit scripted by nukedx Contacts ICQ: 10072 MSN/Main: [email protected] web: www.nukedx.com Original advisory: http://www.nukedx.com/?viewdoc=28 Usage: ladder.pl host path cmd Dork: "Ladder Scripts by http://www.mygamingladder.co...