Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Mozilla Working on More "Attack Aware" Applications

Mozilla is working on making their web applications more “attack aware,” according to a blog post on the company’s Web Application Security blog Wednesday. In the blog post, Mozilla’s web security nomad Michael Coates, discusses how these “attack aware” applications will be able to differentiate...

CVE-2011-0399

PIWIK (before 1.1) is vulnerable to clickjacking because the login form can be rendered within a frame by a third-party page. Root cause: login page displayed in an iframe without proper frame busting. Impact: enables clickjacking via a crafted site. Exploitation details are not provided in the d...

SQL injection authentication bypass

Added: 01/04/2011 Background Structured Query Language SQL is the most common language understood by modern relational databases. Problem A web program uses input parameters within an SQL query in an unsafe manner. This could allow a remote attacker to manipulate the authentication query via a...

Softbiz PHP Joke Site Software SQL Injection

/ / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID ----------------------------------------------------------------------- Softbiz...

XSS vulnerability in Global Reports macro

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence global-reports macro. XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. You can read more about XSS attacks at various places on the web, including these:...

XSS vulnerability in Global Reports macro

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence global-reports macro. XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. You can read more about XSS attacks at various places on the web, including these:...

XSS vulnerability in Bookmarks macro

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence bookmarks macro. XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. You can read more about XSS attacks at various places on the web, including these:...

Web Crawler : Web Application Crawler - New Release

Web Crawler is a open source application that is based on the WebEngine library. WebEngine is the set of tools for performing black-box web-sites testing and other similar tasks. It provides tools means for reception of documents from a web-server, parse HTML pages, their comparisons, search...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Drive-By Downloads Still Running Wild

For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better. The attack landscape has shifted in a lot of important ways in the last few years, but none of the changes ha...

Penetration Tester XSSer v1.0 - New Version Download

All of you web application penetration testers, check out this release of XSSer version 1.0! From this release, the author plans to rename XSSer to "The Mosquito". Our first post regarding XSSer can be found here. "XSSer is an open source penetration testing tool that automates the process of...

Joomla Forms Local File Inclusion / Download

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Joomla Component comforms Multiple Vulnerabilities Date: 7-11-2010 Author: Th3 RDX Software Link: n/a Version: n/a Tested on: online Sites category: webapp/Joomla Code : n/a Google Dork :...

CommonSense CMS Sql Injection Vulnerability

Exploit Title: CommonSense CMS Sql Injection Vulnerability --- Platform / Tested on: Win/Linux --- category: webapps/0day --- Code : https://site/article.php?articleid=SQL --- Dork : "Powered by CommonSense CMS" --- Found this article interesting? Follow us on Twitter  and LinkedIn to read more...

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750)

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...

Site2Nite Auto E-Manager SQL Injection

================================================== Auto e-Manager = SQL Injection Vulnerability ================================================== My + Author : KnocKout Contact : [email protected] + Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB H4X0RE SECURITY PROJECT Software info Web App. :...

TradeMC E-Ticaret - SQL Injection / Cross-Site Scripting

=================================================== TradeMC E-Ticaret - SQLi/XSS Multiple Vulnerabilities =================================================== My + Author : KnocKout Contact : [email protected] + Special Thanks : H4x0re Security 2010, inj3ct0r team Software info Web App. : TradeMC...

PixelPost 1.7.3 Cross Site Request Forgery / Cross Site Scripting

1 +Exploit Title: pixelpostv1.7.3 Multiple vulnerabilities 0 0 +Date: 15/09/2010 1 1 +Author: Sweet 0 0 +Contact : [email protected] 0 1 +Software Link: http://www.pixelpost.org/ 0 0 +Download: http://www.pixelpost.org/ 1 1 +Version: 1.7.3 0 0 +Tested on: WinXp sp3 1 1 +Risk :Hight 0 0...

Micronetsoft RV Dealer Website - SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Micronetsoft RV Dealer Website SQLi Vulnerability Vendor url:http://www.micronetsoft.com Version:1 Price:199$ Published: 2010-09-06 GThanx to:r0073r inj3ct0r.com, Sid3^effects, MaYur, MA1201, Sonic Bluehat, M4n0j,NoCare,...

iGaming CMS - Multiple SQL Injections

iGaming CMS - Multiple SQL Injections Exploit Title: iGamingCMS1.5 multiple vulnirabilities Date: 27/08/2010 Author: Sweet Contact : [email protected] Software Link: http://www.igamingcms.com/ Download: http://forums.igamingcms.com/forumdisplay.php?f=5 Version:1.5 Tested on: WinXp sp3 Risk : hi...