Cross-Site scripting vulnerability in extension t3blog (t3blog)

It has been discovered that the extension "T3Blog" t3blog is vulnerable to Cross-Site Scripting. Release Date: September 27, 2011 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.1 and all versions below...

Remote file inclusion

PHP remote file inclusion vulnerability in indexinc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the incordner parameter...

Emerson.com Cross Site Scripting

One of the pages in Emerson site are rendering the query string parameter without any inspection. This makes it possible to inject malicious content as shown below:...

Miscode Blind SQL Injection

. . . . | | | / || \ \ | / | | / \ / | / \ / \ / \ / /| |\ \ / \ / \ / / \ / | / \ \ \ | || | / // | | | \ / \ \ | | / | | \ \ / // | \ / | | / |||| /\ | / || / \ / || /|| / \ / / \ | \ || / / / / / / / / / /...

Microsoft Remote Desktop Web Access Cross-Site Scripting (MS11-061; CVE-2011-1263)

The Remote Desktop feature enables access to all of the programs, resources, and accessories on a user's computer from another Windows-based computer running the feature. A cross-site scripting vulnerability has been reported in Microsoft Windows Remote Desktop Web Access. The vulnerability is du...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager AWCM 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the themefile parameter to 1 includes/windowtop.php and 2 header.php, and the 3 langfile parameter to control/common.php...

CVE-2010-4810

Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager AWCM 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the themefile parameter to 1 includes/windowtop.php and 2 header.php, and the 3 langfile parameter to control/common.php...

iSupport 1.8 - SQL Injection

iSupport 1.8 SQL Injection Vulnerability Date: 2011-06-23 Author: Brendan Coles Advisory: http://itsecuritysolutions.org/2011-06-23-iSupport-1.8-SQL-Injection-Vulnerability/ Software: iSupport Version: = 1.8 Homepage: http://www.idevspot.com/iSupport.php Google Dork: "Powered by iSupport 1.8 "...

CVE-2011-1699

Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted uri parameter in a printer-url...

CVE-2011-2153

CVE-2011-2153 affects SmarterTools SmarterStats 6.0 Web server. The vulnerability arises from Login.aspx accepting txtUser/txtPass in the query string, enabling context-dependent attackers to discover credentials by reading server access logs, Referer logs, or browser history (cross-domain Refere...

CVE-2011-1669

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F encoded dot dot sequences in the url parameter...

Directory traversal

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote attackers to read arbitrary files via ..%2F encoded dot dot sequences in the url parameter...

Tramot CMS Local File Inclusion

Coder : baltazar a.k.a b4ltazar CMS name : Tramot CMS WebSite : http://www.tramot.com/ Dork : inurl:downloadfile.php?file= site:hr LFI Vuln : http://www.site.hr/downloadfile.php?file=LFI greetz for d3hydr8, rsauron, low1z, qk, marezzi, StRoNiX, t0r3x, fx0, r0x and all members of ex darkc0de.com ,...

Unfixed XSS vulnerability at yellowpages.wsee.tv

Security researcher p0pc0rn, has submitted on 23/02/2011 a cross-site-scripting XSS vulnerability affecting yellowpages.wsee.tv, which at the time of submission ranked 11890905 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 11/12/2011. It is...

Novell iPrint Client Netscape Plugin call-back-url Parameter Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell iPrint Client. Authentication is not required to exploit this vulnerability. The flaw exists within the npnipp.dll Mozilla browser plugin for iPrint client. When assembling a URL using the...

CVE-2010-4361

Cross-site scripting XSS vulnerability in url-gateway.php in Jurpopage 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Angel LMS 7.3 Cross Site Scripting

I have discovered a security exploit in Angel LMS 7.3 "Colleges and universities worldwide choose the ANGEL LMS to deliver powerful online teaching and learning experiences. ANGEL provides the comprehensive LMS features institutions need in a simple interface that promotes adoption. A recognized...

CVE-2010-4097

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

CVE-2010-3425

Cross-site scripting XSS vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter...