Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Aardvark Topsites PHP 5.2 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/35506/info Aardvark Topsites PHP is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based...

Jeremiah Grossman on Web App Security, Secure Development and When Web Security Will Improve

Dennis Fisher talks with Jeremiah Grossman, CTO and founder of WhiteHat Security, about the company’s new Website Vulnerability Statistics report, why SQL injection is still such a problem and when Web application security may improve. Download Subscribe to the Digital Underground podcast on...

SQL injection tactics revealed

SQL injection attacks have become the most reliable way for hackers to gain access to valuable data on back-end systems, with many high-profile Web sites falling victim to the technique over the last couple of years. The attacks themselves are fairly straightforward, but the results can be...

Summary:easy is the hack attack 1 0 a vulnerability-vulnerability warning-the black bar safety net

Application-level security vulnerabilities are usually not as similar to the SirCam email virus such as Code Red this worm so easy to widely spread, but they will also cause a lot of problems, from the theft of product or information to make the entire Web site was completely paralyzed. Ensure th...

[DSECRG-09-038] Sun Glassfish Woodstock Project - Linked XSS Vulnerability

Digital Security Research Group DSecRG Advisory DSECRG-09-038 Original advisory: http://dsecrg.com/pages/vul/show.php?id=138 Application: Sun Glassfish Woodstock Project part of Glassfish Enterprise Server Versions Affected: 4.2 Vendor URL: https://woodstock.dev.java.net/ Bug: Linked XSS...

WysGui CMS 1.2b - Insecure Cookie Handling Blind SQL Injection

WysGui CMS 1.2b - Insecure Cookie Handling Blind SQL Injection !/usr/bin/perl || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...

ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection

riginal advisory: http://dsecrg.com/pages/vul/show.php?id=137 Digital Security Research Group DSecRG Advisory DSECRG-09-037 Application: AbleSpace Versions Affected: 1.0 Vendor URL: http://abk-soft.com/ Bugs: Multiple Blind SQL Injections, Multiple XSS Exploits: YES Reported: 18.03.2009 Vendor...

CVE-2008-6629

CVE-2008-6629: XSS in WEBBDOMAIN Multi Languages WebShop Online 1.02 (detail.php) via the name parameter. The vulnerability arises from unsanitized input in a detail.php parameter, enabling remote script/HTML injection. Affected software is briefly identified as WEBBDOMAIN Multi Languages WebShop...

Kim Websites 1.0 - Authentication Bypass

Kim Websites 1.0 SQL Injection Vulnerability Authentication bypass Virangar Security Team www.virangar.net -------- Discoverd By : Virangar Security Teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & Ariasecurity team & all hackerz greetz:to my best frien...

CVE-2009-0860

CVE-2009-0860: XSS in the web UI of NetMRI 3.0.1 and earlier, related to error pages. The vulnerability is in the login application’s web interface, allowing remote script/HTML injection via unspecified vectors. CVSS v2 base score 4.3 (Medium) with network attack vector, require no authentication...

A recap of the 2nd OWASP conference

The second Open Web Application Security Project OWASP Conference held on the Gold Coast is regarded as the leading Web Application Security conference within the Asia Pacific region attracting both Australian and overseas speakers and attendees. The conference continued its community atmosphere...

Zabbix 1.6.2 Frontend - Multiple Vulnerabilities

Zabbix 1.6.2 Frontend Multiple Vulnerabilities Name Multiple Vulnerabilities in Zabbix Frontend Systems Affected Zabbix 1.6.2 and possibly earlier versions Severity High Impact CVSSv2 High 9.7/10, vector: AV:N/AC:L/Au:N/C:P/I:C/A:C Vendor http://www.zabbix.com/ Advisory...

Ewebeditor2.8.0最终版删除任意文件漏洞

eWebEditor是基于浏览器的、所见即所得的在线HTML编辑器。她能够在网页上实现许多桌面编辑软件（如：Word）所具有的强大可视编辑功能。WEB开发人员可以用她把传统的多行文本输入框TEXTAREA替换为可视化的富文本输入框，使最终用户可以可视化的发布HTML格式的网页内容。eWebEditor!已基本成为网站内容管理发布的必备工具！ 此漏洞存在于Example\NewsSystem目录下的delete.asp文件中，这是ewebeditor的测试页面，无须登陆可以直接进入，看这些代码： ‘ 把带”|”的字符串转为数组 Dim aSavePathFileName...

Synactic ALL_IN_THE_BOX File Overwrite

DSECRG-09-006 Synactis AllINTHEBOX ActiveX Control - Null byte File Owervrite Synactis AllINTHEBOX ActiveX Control ALLINTHEBOX.OCX can be used to owervrite any any file in target system. Vulnerable method is "SaveDoc" Application: Synactis AllINTHEBOX ActiveX Versions Affected: 3 Vendor URL:...

Sad Raven Guetbook 1.1 passwd.dat Disclosure

!/usr/bin/python Portal Name: Sad Raven's Guestbook version: 1.1 Google Dork: sad Raven's Guestbook Exploit Coded by: PouyaServer Exploit Discovered by: PouyaServer Contact Me: [email protected] import urllib import sys import parser serv="http://" i=0 for arg in sys.argv: i=i+1 if i!=3: pri...

Joomla com_pcchess (game_id) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== Joomla compcchess gameid Blind SQL Injection Exploit ======================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Power Phlogger: SQL injection, DoS...

DMXReady Secure Document Library 1.1 SQL Injection

Title : DMXReady Secure Document Library http://target/path/applications/SecureDocumentLibrary/incsecuredocumentlibrary.asp Edit - http://target/path/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/uploadimagecategory.asp?cid= SQL Inject Example: USERNAME-...

phpList cline Parameter Array Remote File Inclusion

The version of phpList installed on the remote host fails to filter user input to the 'clinec' parameter before passing it to a PHP 'include' function in 'admin/index.php'. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker can exploit this issue to view arbitrary files on...