3357 matches found
DCP-Portal 5.5 advertiser.php password Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/8739/info Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks hav...
Mambo Component Quran <= 1.1 (surano) SQL Injection Vulnerability
No description provided by source. +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...
PHP Arena paFileDB 1.1.3/2.1.1/3.0/3.1 - Arbitrary File Upload And Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8271/info It has been reported that a script contained in paFileDB does not properly verify user credentials before accepting files for upload. As a result, remote attackers may be able to upload files to the Web server...
Kasseler CMS 1.4.x lite (Module Jokes) SQL-Injection Exploit
No description provided by source. ?php echo \n\n\n; echo \n; echo Product: Kasseler CMS 1.4.x lite Module Jokes SQL-Injection Exploit \n; echo Usage: php.exe kasseler.php www.site.com /cmspath/ \n; echo Require: Magicquotes = off \n; echo Author: Sc0rpi0n RUS http://scorpion.su \n; echo Special...
Supernews <= 2.6.1 - SQL Injection Exploit
No description provided by source. ?php Exploit Title: Supernews = 2.6.1 SQL Injection Exploit Google Dork: intext:2003 - 2004 : SuperNews : Todos os direitos reservados Date: 2012/ Author: WhiteCollarGroup Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews Version: 2.6.1 Tested on:...
SqWebMail 5.0 .4 HTML Email IMG Tag Script Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14676/info SqWebMail is affected by a vulnerability that may allow remote attackers to inject and execute arbitrary script code in a user's browser. This may allow for various attacks including session hijacking due to th...
Abyss Web Server X1 - CSRF
No description provided by source. http://osvdb.org/show/osvdb/64693 http://osvdb.org/show/osvdb/64693 http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html : Abyss Web Server X1 XSRFhttp://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html A cross-si...
Flat PHP Board <= 1.2 - Multiple Vulnerabilities
No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org...
MangosWeb SQL Injection Vulnerability
No description provided by source. EXPLOIT TITLE: MangosWeb SQL Vulnerability DATE: 1/7/2012 BY Hood3dRob1n AFFECTED PRODUCTS: MangosWeb Enhanced Version 3.0.3 SW LINK: http://code.google.com/p/mwenhanced/ CATEGORY: WebApp 0day DORK: intext:MangosWeb ENhanced Version 3.0.3 @2009-2011, KeysWow Dev...
DCP-Portal 5.5 lostpassword.php email Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/8739/info Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks hav...
Gallery <= 2.0.3 stepOrder[] Remote Commands Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo Gallery =2.0.3 \stepOrder\ remote cmmnds xctn \r\n; echo by rgod rgodATautisticiDOTorg \r\n; echo site: http://retrogod.altervista.org \r\n\r\n; echo - works with registerglobals = On and magicquotesgpc = Off \r\n; if...
ASPApp PortalAPP 0 Remote User Database Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9354/info A problem has been identified in ASPapp PortalApp when user credentials are stored on a system. Because of this, an attacker may be able to gain unauthorized access to sensitive information...
Ingenium Learning Management System 5.1/6.1 Reversible Password Hash Weakness
No description provided by source. source: http://www.securityfocus.com/bid/5970/info Ingenium Learning Management System uses a weak algorithm to hash user and administrative credentials. Passwords may be trivially obtained by reversing the password hash. An attacker must be able to gain...
OpenBB 1.0.x Private Message Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10217/info It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials. This issue might allow an attacker to rea...
PHPizabi 0.848b C1 HFP3 - Database Information Disclosure Vuln
No description provided by source. -------------------------------------------------------- PHPizabi v0.848b C1 HFP3 database information exposure -------------------------------------------------------- I would like to state that I am in no way responsible for how this information is used. It is...
FOSCAM IP-Cameras Improper Access Restrictions
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Cloned Android Banking App Hides Phishing Scheme
Cloned mobile applications, such as the legions of Flappy Bird knock-offs that surfaced once the popular game was removed from Google Play and the Apple App Store, are an increasingly popular malware vehicle for attackers. The risks range from loading programs that dial premium numbers at the...
OpenSSL Heartbleed Patch Progress Slowing Two Months Later
It’s been more than two months since news broke of the Heartbleed vulnerability in OpenSSL one of the Internet’s most widely deployed cryptographic libraries. In the days and weeks that followed the emergence of the bug, which affected an unknown but arguably vast swath of the Web, vendors were...
WordPress Booking System SQL Injection
Exploit Title: Wordpress Booking System Booking Calendar plugin SQL Injection Release Date: 2014-05-21 Author: maodun Contact: Twitter: @conmancm Software Link: http://wordpress.org/support/plugin/booking-system Affected version:...
Bitly Compromised, Users Urged to Change Passwords
Link shortening service Bitly informed its users Thursday that it believes user credentials – passwords, API keys and OAuth tokens – have been compromised. While the company claims there’s no real indication that any accounts were accessed without authorization, in a post on its blog the company...