[Arachni v0.4.2] web application security scanner (Boosted with new UI)

Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. It is smart, it trains itself by learning from the HTTP responses it receives during the audit process and is...

phpMyAdmin Authenticated Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'phpMyAdmin Authenticated Remote Code...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3, and 8, allow remote attackers to inject content, and conduct phishing attacks, via vectors involving 1 the html/en/default/ directory, 2 birt/frameset, 3 WebProcess.srv, 4...

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities Advisory ID: HTB23150 Product: KrisonAV CMS Vendor: http://www.krisonav.com Vulnerable Versions: 3.0.1 and probably prior Tested Version: 3.0.1 Vendor Notification: March 27, 2013 Vendor Patch: March 31, 2013 Public Disclosure: April 17, 2013...

WordPress Plugin Spiffy XSPF Player - 'playlist_id' SQL Injection

source: https://www.securityfocus.com/bid/58976/info Spiffy XSPF Player plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

[Acunetix Web Vulnerability Scanner 8] Automated Web Application Security Testing Tool

Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...

IBM Rational AppScan Enterprise SQL注入漏洞

BUGTRAQ ID: 58686 CVECAN ID: CVE-2013-0511 IBM Rational AppScan是应用安全性软件，能够在开发的各个阶段扫描并测试所有常见的Web应用漏洞。 IBM Rational AppScan Enterprise 8.6 - 8.6.0.2没有正确过滤SQL查询内使用的某些输入，可导致SQL注入漏洞。 0 IBM Rational AppScan 8.x IBM Rational AppScan 5.x 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

AContent 1.3 - Local File Inclusion

AContent 1.3 - Local File Inclusion Exploit Title: AContent 1.3 Local File Inclusion Date: 21-03-2013 Author: DaOne Vendor Homepage: http://atutor.ca/acontent/ Software Link: https://sourceforge.net/projects/acontent/files/AContent-1.3.tar.gz/download Category: webapps/php Version: 1.3 Tested on:...

Internet Explorer 8 Exploit Found in Watering Hole Campaign Targeting Chinese Dissidents

On March 16th, we discovered a premeditated waterhole campaign that hosts exploits and malware on websites frequented by a specific target group. In this case the target includes Chinese dissidents. For the attacker, this approach is highly attractive since it is very difficult to discover the...

[WAppEx v2.0] Web Application Exploitation Tool

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Joomla! Component com_collector - Arbitrary File Upload

Exploit Title:Joomla comcollecter shell upload Author: Red Dragonal Alb0zZ Team Home :HackForums.AL,alb0zz.in Date :19/01/2013 Category:: web apps Google dork: inurl:index.php?option=comcollector Tested on: Windows XP Download: http://www.steevo.fr/en/download Home Page: http://www.steevo.fr/...

XSS vulnerability in source tab configure project

Create a new group named "alert"XSS" 2. In the OnDemand administration section click Fisheye, then Configure to the right of the project name This vulnerability is due to an unescaped group.name parameter in projectrepositorypermissions.vm e.g...

BigDump 0.29b and 0.32b - Multiple Vulnerabilities

BigDump 0.29b and 0.32b - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/56744/info BigDump is prone to a cross-site scripting vulnerability, an SQL-injection vulnerability, and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data. Exploiting...

[CVE-2012-5777]EmpireCMS Template Parser Remote PHP Code Execution Vulnerability

Exploit Title : Answer my question wordpress plugin Multiple Cross-Site Scripting Vulnerabilities Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 09/19/12 version: 1.1 software link:http://wordpress.org/extend/plugins/answer-my-question/ Answer my question plugin description This plugi...

[Burp Suite] Free Edition v1.5

Burp Suite helps you secure your web applications by finding the vulnerabilities they contain. Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking ...

Achievo 1.4.5 - Multiple Vulnerabilities (1)

Information -------------------- Name : XSS, LFI and SQL Injection Vulnerabilities in Achievo Software : Achievo 1.4.5 and possibly below. Vendor Homepage : http://www.achievo.org Vulnerability Type : Cross-Site Scripting, Local File Inclusion and SQL Injection Severity : Critical Researcher :...

World Health Organization website hacked by NullCrew

A well known hacking group "Nullcrew" once again most active hacking group right now. Dumping database from number of websites daily. Their latest target was World Health Organization WHO website. Well, World Health Organization website who.int need treatment now, because their admin panel...

CMSMini 0.2.2 Cross Site Scripting

Information -------------------- Name : XSS Vulnerabilities in CMSMini Software : CMSMini 0.2.2 and possibly below. Vendor Homepage : http://sourceforge.net/projects/cmsmini/ Vulnerability Type : Cross-Site Scripting Severity : Critical Researcher : Canberk Bolat Advisory Reference : NS-12-012...

How to Minimize Web Application Security Risk !

With Web applications remaining a popular target for attackers, Web app security sometimes seems like a digital version of the "Good, the Bad and the Ugly." Vulnerabilities in web applications are now the largest vector of enterprise security attacks. Web application security is much more...