3105 matches found
Gene6 BPFTP FTP Server 2.0 User Credentials Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2534/info G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6 If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user could force the FTP...
Gallery <= 2.0.3 stepOrder[] Remote Commands Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo Gallery =2.0.3 \stepOrder\ remote cmmnds xctn \r\n; echo by rgod rgodATautisticiDOTorg \r\n; echo site: http://retrogod.altervista.org \r\n\r\n; echo - works with registerglobals = On and magicquotesgpc = Off \r\n; if...
PHP Arena paFileDB 1.1.3/2.1.1/3.0/3.1 - Arbitrary File Upload And Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8271/info It has been reported that a script contained in paFileDB does not properly verify user credentials before accepting files for upload. As a result, remote attackers may be able to upload files to the Web server...
CitrusDB 0.3.6 importcc.php CSV File SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the...
Easynet Forum Host - (topic.php) SQL Injection Vulnerbility
No description provided by source. Exploit Title: Easynet Forum Host topic.php SQL Injection Vulnerbility Date: 05/04/2008 Author: Pr0T3cT10n Software Link: http://www.easynet4u.com/forum Version: all Tested on: all CVE: Code: //------------------------------------------------ // Easynet Forum Ho...
ProductCart 1.x/2.x Weak Cryptography
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...
FOSCAM IP-Cameras Improper Access Restrictions
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MayGion IP Cameras multiple vulnerabilities 1. Advisory Information Title: MayGion IP Cameras multiple vulnerabilities Advisory ID: CORE-2013-0322 Advisory URL:...
Mambo Component Quran <= 1.1 (surano) SQL Injection Vulnerability
No description provided by source. +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breakerunit and Don...
ASPApp PortalAPP 0 Remote User Database Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9354/info A problem has been identified in ASPapp PortalApp when user credentials are stored on a system. Because of this, an attacker may be able to gain unauthorized access to sensitive information...
Ingenium Learning Management System 5.1/6.1 Reversible Password Hash Weakness
No description provided by source. source: http://www.securityfocus.com/bid/5970/info Ingenium Learning Management System uses a weak algorithm to hash user and administrative credentials. Passwords may be trivially obtained by reversing the password hash. An attacker must be able to gain...
Telia Web Design (index.php) SQL Injection Vulnerability
No description provided by source. ------------------------------------------------------------------------------------------- Telia Web Design index.php SQL Injection Vulnerability ------------------------------------------------------------------------------------------- Author: CoBRa21 Mail:...
DCP-Portal 5.5 lostpassword.php email Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/8739/info Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks hav...
Citrix MetaFrame 1.0/1.8 Weak Encryption Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1077/info The ICA protocol uses a simple XOR-based encryption algorthm to protect user credentials while stored or in transit. This encryption can be easily broken, meaning that anyone sniffing the connection can obtain...
ProductCart 1.x/2.x Custva.asp redirectUrl Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/9669/info EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data suc...
DCP-Portal 5.5 advertiser.php password Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/8739/info Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks hav...
Supernews <= 2.6.1 - SQL Injection Exploit
No description provided by source. ?php Exploit Title: Supernews = 2.6.1 SQL Injection Exploit Google Dork: intext:2003 - 2004 : SuperNews : Todos os direitos reservados Date: 2012/ Author: WhiteCollarGroup Software Link: http://phpbrasil.com/script/vT0FaOCySSH/supernews Version: 2.6.1 Tested on:...
Cloned Android Banking App Hides Phishing Scheme
Cloned mobile applications, such as the legions of Flappy Bird knock-offs that surfaced once the popular game was removed from Google Play and the Apple App Store, are an increasingly popular malware vehicle for attackers. The risks range from loading programs that dial premium numbers at the...
OpenSSL Heartbleed Patch Progress Slowing Two Months Later
It’s been more than two months since news broke of the Heartbleed vulnerability in OpenSSL one of the Internet’s most widely deployed cryptographic libraries. In the days and weeks that followed the emergence of the bug, which affected an unknown but arguably vast swath of the Web, vendors were...
WordPress Booking System SQL Injection
Exploit Title: Wordpress Booking System Booking Calendar plugin SQL Injection Release Date: 2014-05-21 Author: maodun Contact: Twitter: @conmancm Software Link: http://wordpress.org/support/plugin/booking-system Affected version:...
Bitly Compromised, Users Urged to Change Passwords
Link shortening service Bitly informed its users Thursday that it believes user credentials – passwords, API keys and OAuth tokens – have been compromised. While the company claims there’s no real indication that any accounts were accessed without authorization, in a post on its blog the company...