[Call for Article] The Hacker News Magazine - November 2011 Edition

Call for Article The Hacker News Magazine - November 2011 Edition The Hacker News is starting to prepare the next issue of 'The Hacker News Magazine'. Submissions are invited for a 6th up coming special November Issue as "Anniversary Edition ". If you have something interesting to write, please...

[Call for Article] The Hacker News Magazine - November 2011 Edition

Call for Article The Hacker News Magazine - November 2011 Edition The Hacker News is starting to prepare the next issue of 'The Hacker News Magazine'. Submissions are invited for a 6th up coming special November Issue as "Anniversary Edition". If you have something interesting to write, please dr...

Apache Struts ParametersInterceptor Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/codeexecparameters msf undefinedcodeexecparameters show actions ...actions... msf undefinedcodeexecparameters set ACTION msf undefinedcodeexecparameters show options ...show and s...

GMER 1.0.15.15641 MFT Overwrite

include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application description GMER is an application...

Cogent Datahub 7.1.1.63 Buffer Overflow

!/usr/bin/python Cogent Datahub @netninja || @luigiauriemma example usage: mrme@neptune cognet$ ./cognetoverflow.py 192.168.114.130 ----------------------------------------------------- ------ Cogent Datahub Unicode Overflow Exploit ------ ------------- Found by Luigi Auriemma ---------------...

Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection

Summary Toko Web Content Editor cms is a compact, multi language, open source web editor and content management system CMS. It is advanced easy to use yet fully featured program that can be integrated with any existing site. It takes 2 minuets to install even for non technical users. Description...

RealNetworks Realplayer QCP Parsing Heap Overflow

This module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute...

DB S Bahn Muenchen - SQL Injection Vulnerability

Document Title: =============== DB S Bahn Muenchen - SQL Injection Vulnerability Release Date: ============= 2011-08-14 Vulnerability Laboratory ID VL-ID: ==================================== 167 Product & Service Introduction: =============================== Official Website of Deutsche Bahn...

Microsoft MPEG Layer-3 Audio - Stack Overflow (MS10-026) (Metasploit)

$Id: ms10026avinsamplespersec.rb 13555 2011-08-13 02:15:05Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

ATutor AContent 1.1 / 1.3 Cross Site Scripting

AContent 1.1 Multiple Cross-Site Scripting Vulnerabilities Vendor: ATutor Inclusive Design Institute Product web page: http://www.atutor.ca Affected version: 1.1 build r296 Summary: AContent is an open source learning content authoring system and respository used to create interoperable,...

Multiple XSS in GBook PHP guestbook

Vulnerability ID: HTB23028 Reference: http://www.htbridge.ch/advisory/multiplexssingbookphpguestbook.html Product: GBook PHP guestbook Vendor: PHPJunkyar http://www.phpjunkyard.com Vulnerable Version: 1.7 and probably prior Tested on: 1.7 Vendor Notification: 06 July 2011 Vulnerability Type: XSS...

cFTP <= 0.1 (r80) Arbitrary File Upload

No description provided by source. ?php Exploit Title: cFTP = 0.1 r80 Arbitrary File Upload Date: 2011-07-29 Author: leviathan vulnerability discovered by Simon Leblanc : https://code.google.com/p/clients-oriented-ftp/issues/detail?id=78 Software Link:...

Online Grades 3.2.5 Multiple XSS Vulnerabilities

Summary Online Grades is the leading free-software project that allows K-12+ student grades attendance information to be posted onto a dynamic web site. Description Online Grades suffers from multiple cross-site scripting vulns. The issue is triggered when input passed via multiple parameters to...

Spider Player v2.3.11 - Memory Corruption Vulnerability

Document Title: =============== Spider Player v2.3.11 - Memory Corruption Vulnerability Release Date: ============= 2011-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 97 Product & Service Introduction: =============================== Spider Player supports nearly...

HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass

Document Title: =============== HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass Release Date: ============= 2011-07-19 Vulnerability Laboratory ID VL-ID: ==================================== 185 Product & Service Introduction: =============================== Der HTC HD2 liefert Ihnen ein...

Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities

Document Title: =============== Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities Release Date: ============= 2011-07-18 Vulnerability Laboratory ID VL-ID: ==================================== 105 Product & Service Introduction: =============================== Pandora FMS is a monitorin...

Tugux CMS 1.2 (pid) Remote Arbitrary File Deletion Vulnerability

Summary Tugux CMS is a free, open-source content Management system CMS and application that powers the entire web. Description Input passed to the 'pid' parameter in administrator/deletepageparse.php is not properly sanitised before being used to delete files. This can be exploited to delete file...

Sitemagic CMS 2010.04.17 Cross Site Scripting

Sitemagic CMS 2010.04.17 SMExt Remote Cross-Site Scripting Vulnerability Vendor: Sitemagic CMS Product web page: http://www.sitemagic.org Affected version: 2010.04.17 Summary: Sitemagic CMS is a fantastic new platform for building and maintaining great looking websites. It is very easy to set up...

WeBid 1.0.2 Cross Site Scripting / SQL Injection

Exploit Title: presistent XSS through SQLi WeBid 1.0.2 Google Dork: "powered by WeBid" Date: 15-06-2011 Author: Saif El-Sherei Software Link: http://sourceforge.net/projects/simpleauction/ Version: 1.0.2 Tested on: Firefox 4, XAMPP Info: Open source php/mysql fully featured auction script. Perfec...

Pacer Edition CMS 2.1 - l Local File Inclusion

Pacer Edition CMS 2.1 - l Local File Inclusion Pacer Edition CMS 2.1 l param Local File Inclusion Vulnerability Vendor: The Pacer Edition Product web page: http://www.thepaceredition.com Affected version: RC 2.1 SVN: 867 Summary: The 'Pacer Edition' is a Content Management SystemCMS written using...