Wiki Spot Cross Site Scripting

Exploit Title: Wiki Spot Cross Site Scripting Date: 18.02.2012 Author: Sony Software Link: http://wikispot.org/ Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/02/wiki-spot-cross-site-scripting.html...

Secretary <= 1.2 CSRF Remote User Settings Change

Exploit for php platform in category web applications ================================================= Secretary Date: 3/11/2010 Site: http://www.giudinvx.altervista.org/ -------------------------------------------------------- Application Info: THE SECRETARY A portfolio management system for...

DiamondList - '/user/main/update_settings?setting[site_title]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/42252/info DiamondList is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow...

e107 0.7.21 cross site scripting vulnerability-vulnerability warning-the black bar safety net

http://127.0.0.1/e107/usersettings.php and Edit Signature / Timezone Put this code Or other's Edit signature/time zone to put this code """scriptlocation="http://www.myhack58.com"/script"""" ScRiPtalert3 3 0 8 9 6 3 2/ScRiPt...

e107 0.7.21 cross site scripting Vulnerabilities

No description provided by source. After Rigester Go to user Seting 1 - http://127.0.0.1/e107/usersettings.php and Edit Signature / Timezone Put this code Or other's """scriptlocation="http://w ww.arab-blackhat.co.cc"/script"""" ScRiPtalert213771818860/ScRiPt Dz-Ghost Team ===== Saoucha Star08...

e107 content management system usersettings. php page there is SQL injection vulnerability-vulnerability warning-the black bar safety net

e107 is a php written content management system. e107 of the usersettings. php page existsSQL injectionvulnerabilities: if $ret == ’ $loginname = striptags$POST’loginname’; if !$ loginname $loginname = $udata’userloginname’; else if! checkclass$pref’displaynameclass’, $udata’userclasslist’, $peer...

Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities

No description provided by source. ------------------------------------------------------------------------------------------------- Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.comhttp://gmail.com Date: 11. December 2009...

Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities

Exploit for unknown platform in category web applications ======================================================= Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities =======================================================...

Chipmunk Board Script 1.x - Multiple Cross-Site Request Forgery Vulnerabilities

------------------------------------------------------------------------------------------------- Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 11. December 2009...

Chipmunk Board Script 1.x XSRF

------------------------------------------------------------------------------------------------- Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities Author: Milos Zivanovic Date: 11. December 2009...

Chipmunk Board Script 1.x - Multiple Cross-Site Request Forgery Vulnerabilities

Chipmunk Board Script 1.x - Multiple Cross-Site Request Forgery Vulnerabilities ------------------------------------------------------------------------------------------------- Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.co...

Oracle Document Capture BlackIce Stack Buffer Overflow

var devmode = new ActiveXObject"BLACKICEDEVMODE.BlackIceDEVMODECtrl.1"; //user add, user: sun pass: tzu scode = unescape "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" + "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" + "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +...

CVE-2008-6539

Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destarcfg.py via a crafted pin parameter...

CVE-2008-6539: Improper Control of Generation of Code

Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destarcfg.py via a crafted pin parameter...

NetworkManager: local users can modify the connection settings

GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus 1 modify and 2 delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and atconsole...

DEBIAN-CVE-2008-5397

Tor before 0.2.0.32 does not properly process the 1 User and 2 Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process...

e107 <= 0.7.13 (usersettings.php) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================= e107 $val $err = $ue-userextendedvalidateentry$val,$extList$key; if!$err $val = $tp-toDB$val; == Cleans values $uefields .= $key."='".$val."'"; == Here our $POST'ue' keys and...

Destar 0.2.2-5 - Arbitrary Add Admin

!/usr/bin/python Exploit for destar 0.2.2-5, tested on Linux Debian Bug found and exploit coded by a non root user http://nonroot.blogspot.com/ Enero 2008 This is a PoC, please use it just for learning how to exploit something use: $python ./exploitcode.py required: urllib, sys and re import urll...

Privilege escalation

The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 formerly CRM-CTT does not properly verify user privileges, which allows remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass intended access restrictions and edit non-active user settings. NOT...

CVE-2007-6222

The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 formerly CRM-CTT does not properly verify user privileges, which allows remote authenticated users with the LIMITTOCUSTOMERS privilege to bypass intended access restrictions and edit non-active user settings. NOT...