Joomla Googlemaps 3.2 Cross Site Scripting / Denial Of Service

Hello list! Earlier I wrote about multiple vulnerabilities in Googlemaps plugin for Joomla http://securityvulns.ru/docs29645.html. After my informing, the developer fixed these vulnerabilities in versions 2.19 and 3.1 of the plugin - by removing proxy functionality. And in version 3.2 of the plug...

TinyMCE Image Manager 1.1 XSS / File Upload

Hello list! These are Arbitrary File Uploading and Cross-Site Scripting vulnerabilities in TinyMCE Image Manager plugin for TinyMCE. ------------------------- Affected products: ------------------------- Vulnerable are TinyMCE Image Manager 1.1 and previous versions. -------------------------...

Joomla Googlemaps XSS / XML Injection / Path Disclosure / DoS

Hello list! These are Denial of Service, XML Injection, Cross-Site Scripting and Full path disclosure vulnerabilities in Googlemaps plugin for Joomla. ------------------------- Affected products: ------------------------- Vulnerable are Googlemaps plugin for Joomla versions 2.x and 3.x and...

CS, XSS and FPD vulnerabilities in WordPress

Hello 3APA3A! These are Content Spoofing, Cross-Site Scripting and Full path disclosure vulnerabilities in WordPress. At WordPress 3.5.2 release the same at 3.5.1 release, WP developers mentioned about multiple fixed holes, but not about all - to make it looks like there were less fixed holes. So...

[Netsparker v3.0.2.0 Community Edition] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker. It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting XSS, Remote Code Executi...

XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress

Hello 3APA3A! These are Cross-Site Scripting and Full path disclosure vulnerabilities in multiple themes for WordPress with ZeroClipboard.swf. Earlier I've wrote about Cross-Site Scripting vulnerabilities in ZeroClipboard http://seclists.org/fulldisclosure/2013/Feb/103. I wrote that this is very...

XSS and CS vulnerabilities in Dotclear

Hello 3APA3A! These are Cross-Site Scripting and Content Spoofing vulnerabilities in Dotclear. CMS Dotclear has three vulnerable flash-files: swfupload.swf, playerflv.swf and playermp3.swf. File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in Swfupload in November 2012...

XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS

Hello 3APA3A! After my previous list of vulnerable software with ZeroClipboard.swf, here is a list of software with ZeroClipboard10.swf. These are Cross-Site Scripting vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS. Earlier I've wrote about Cross-Site Scripting...

Multiple vulnerabilities in TinyBrowser

Hello 3APA3A! I want to warn you about multiple vulnerabilities in TinyBrowser for TinyMCE. These are new vulnerabilities in addition to my 2009 and 2011 advisories about Arbitrary File Upload and Code Execution vulnerabilities in TinyBrowser. It concerns as TinyBrowser, as all web applications...

XSS vulnerability in swfupload in ExpressionEngine

Hello 3APA3A! Here is information about Cross-Site Scripting vulnerability in swfupload in ExpressionEngine. After publication of my advisory XSS vulnerability in web applications with swfupload: AionWeb, Magento, Liferay Portal, SurgeMail, symfony http://securityvulns.ru/docs28761.html and after...

Libsyn Cross Site Scripting Vulnerability

Libsync suffers from a cross site scripting vulnerability. As you can see from my publications for last five years, I like holes which are placed at hundreds or millions of web sites. Since my 2008's article XSS vulnerabilities in 215000 flash files...

XSS vulnerability in web applications with swfupload: Dotclear, XenForo, InstantCMS, AionWeb, Dolphin

Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...

CSRF and XSS vulnerabilities in IFOBS

Hello 3APA3A! I want to warn you about Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in system IFOBS. IFOBS - it's Internet-banking system, which is widespread and particularly it's used by large number of Ukrainian banks. These are the next 35 vulnerabilities in IFOBS: 1 CS...

XSS, Redirector and FPD vulnerabilities in WordPress

Hello 3APA3A! In June I've disclosed vulnerabilities in WordPress, which I'd present for you. They take place in plugin Akismet for WordPress and it's core-plugin since version WP 2.0, so these vulnerabilities concern WordPress itself. This is the first in series of advisories concerning...

Уязвимости в LIOOSYS CMS

Здравствуйте 3APA3A! Сообщаю вам о SQL Injection и Information Leakage уязвимостях в LIOOSYS CMS. Это польская коммерческая CMS. SQL Injection WASC-19: http://site/index.php?id=-120union20select201,version,3,4,5/ Information Leakage WASC-13: http://site/files/db.log Утечка лога ошибок запросов к...

Yandex.Server 2010 9.0 Enterprise Cross Site Scripting

Hello list! I want to warn you about new Cross-Site Scripting vulnerability in Yandex.Server. Earlier I've informed about other XSS in Yandex.Server CVE-2007-3485 - mentioned about them in my Month of Search Engines Bugs project. And in 2007 I've informed Yandex about them. Which should fix these...

Brute Force и XSS уязвимости в Webglimpse

Здравствуйте 3APA3A! После предыдущих многочисленных Cross-Site Scripting, Full path disclosure, Directory Traversal и Authorization bypass уязвимостей в Webglimpse SecurityVulns ID: 9436, 9443, 9778, 9876, сообщаю вам о найденных мною новых уязвимостях в Webglimpse. Это Brute Force и Cross-Site...

Webglimpse Brute Force / Cross Site Scripting

Hello list! I want to warn you about new security vulnerabilities in Webglimpse in addition to previous ones. These are Brute Force and Cross-Site Scripting vulnerabilities. During 2008-2009 I've disclosed multiple vulnerabilities in Webglimpse http://securityvulns.com/source15611.html, such as...

CS и XSS уязвимости в Zeema CMS

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Content Spoofing и Cross-Site Scripting уязвимостях в системе Zeema CMS. Это украинская коммерческая CMS. Content Spoofing WASC-12: В связи с возможностью прямого обращения к скрипту http://site/counter/counter.php с подделкой параметра ref и...

Zeema CMS Cross Site Scripting / SQL Injection

Hello list! I want to warn you about Cross-Site Scripting, SQL Injection and Information Leakage vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Zeema CMS. ---------- Details:...