Ruby Gem Fastreader 1.0.8 Command Execution Vulnerability

Ruby Gem Fastreader version 1.0.8 suffers from a remote command execution vulnerability due to a lack of user input sanitization. Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 https://rubygems.org/gems/fastreader if the url contains any ; characters code will be executed as the user when a...

Ruby Gem Curl Command Execution

Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl cookiesstore browsertype @setupparams ref "url" " 132 if @debug 133 puts cmd.red 134 end 135 result =...

Gambas /tmp Directory Hijack

Gambas Directory hijack vulnerability The gambas software package creates a directory in tmp to work from without verifying another user hasn't already created it. This allows a local user to hijack ownership. Describe the problem. Gambas creates a directory in /tmp called gambas.UID where UID is...

Hacker Exposes former US President Bush Family Photos and Emails

The hacker, known as Guccifer, targeted several e-mail accounts and exposed personal photos and sensitive correspondence from members of the former US President Bush family, including both former U.S. presidents. Hacked Emails includes the AOL account of his daughter Dorothy Bush Koch; family...

CVE-2012-6523

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

CVE-2012-6523

CVE-2012-6523 describes multiple cross-site scripting (XSS) vulnerabilities in w-CMS 2.01. The flaws allow remote attackers to inject arbitrary web script or HTML via: (1) the p parameter in the getMenus function in codes/wcms.php; and (2) the COMMENT parameter in blog.php, guestbook.php, or foru...

CVE-2012-6523

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

Samsung Acknowledges Exynos Root Exploit

Samsung downplayed a root exploit vulnerability in some of its Exynos processors, and promised a patch for the flaw, according to a company statement acquired by AndroidCentral. The bug affects devices with Exynos 4210 and 4412 processors and was first made public by an XDA Developers forum membe...

W-Agora 4.2.1 SQL Injection

HTTPCS Advisory : HTTPCS79 Product : w-agora Version : 4.2.1 Date : 2012-08-17 Criticality level : Highly Critical Description : A vulnerability has been discovered in w-agora, which can be exploited by malicious people to conduct SQL injection attacks. Input passed via the 'pattern' parameter to...

Safari On iOS Denial Of Service

/PoC for Safari crash discovered by Alberto Ortega @a0rtega, [email protected] http://www.livehacking.com/category/vulnerability/apple-vulnerability/ This PoC written by Larry W. Cashdollar http://vapid.dhs.org @lcashdol This PoC creates an html file to be served out by a normal webserver. It...

w-CMS 2.0.1 CSRF / XSS / File Disclosure / Shell Upload

+----------------------------------------------------------------------+ | | | | | | | | | | \ | | | | | | | | | | | | | | | | | | |/ |/ | |/ / ||| | | | | | | | | | | | | | | | || || | | | |/||,|||\ ||/ | | | |/| | | | x Exploit Title: w-CMS 2.0.1 Multiple Vulnerabilities | | x Google Dork:...

w-CMS 2.0.1 - Multiple Vulnerabilities

w-CMS 2.0.1 - Multiple Vulnerabilities +----------------------------------------------------------------------+ | | | | | | | | | | \ | | | | | | | | | | | | | | | | | | |/ |/ | |/ / ||| | | | | | | | | | | | | | | | || || | | | |/||,|||\ ||/ | | | |/| | | | x Exploit Title: w-CMS 2.0.1...

w-CMS 2.0.1 - Multiple Vulnerabilities

+----------------------------------------------------------------------+ | | | | | | | | | | \ | | | | | | | | | | | | | | | | | | |/ |/ | |/ / ||| | | | | | | | | | | | | | | | || || | | | |/||,|||\ ||/ | | | |/| | | | x Exploit Title: w-CMS 2.0.1 Multiple Vulnerabilities | | x Google Dork:...

Conduit Image Search Engine Cross Site Scripting

TITLE: Conduit Image Search Engine Cross site Scripting vendor: Conduit Author: r007k17-w Email: [email protected] My blog: http://shadowrootkit.wordpress.com/ Google Dork: © 2012 Conduit...

Conduit Wibiya Password Recovery Toolbar Cross Site Scripting

TITLE: Conduit wibiya password recovery toolbar Cross site Scripting vendor: Conduit Author: r007k17-w Email: [email protected] My blog: http://shadowrootkit.wordpress.com/ Google Dork: © 2012 Conduit...

w-CMS HTML Injection and Local File Include Vulnerabilities

w-CMS is prone to multiple HTML-injection vulnerabilities and a local file-include vulnerability. Exploiting these issues could allow an attacker to execute arbitrary HTML and script code in the context of the affected browser, steal cookie-based authentication credentials, and execute arbitrary...

w-CMS <= 2.0.1 Multiple Vulnerabilities - Active Check

w-CMS is prone to multiple HTML-injection vulnerabilities and a local file include LFI vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

w-CMS 2.01 - Multiple Vulnerabilities

w-CMS 2.01 - Multiple Vulnerabilities Exploit Title: W-Cms Multiple Vulnerability Date: 2012-01-09 Author: th3.g4m30v3r Site:http://w-cms.info/ Software Link: http://code.google.com/p/wcms/ Dork: intext:"Powered by w-CMS" Version : 2.01 Tested on: Window 7 Yogesh Kashyap, shubneet goel,...

w-CMS 2.01 Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: W-Cms Multiple Vulnerability Date: 2012-01-09 Author: th3.g4m30v3r Site:http://w-cms.info/ Software Link: http://code.google.com/p/wcms/ Dork: intext:"Powered by w-CMS" Version : 2.01 Tested on: Window 7 Yogesh Kashyap, shubneet...