PNG Counter 1.0 Demo.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14392/info PNG Counter is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web page...

Devana SQL Injection vulnerability

No description provided by source. Exploit Title: Devana SQL Injection vulnerability Date: 28.03.2010 Author: Valentin Category: webapps/0day Version: Tested on: Debian lenny, Apache2, MySQL5 CVE : Code : :: General information :: Devana SQL injection vulnerability detected :: by Valentin Hoebel ...

Secret: Content Sniffing not disabled

URL :- https://www.secret.ly/ Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are...

PYSEC-2014-19

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

kkpw 2.2 /ajax_indus.php SQL注入漏洞

No description provided by source...

NetCms website management system upload vulnerability and fix-vulnerability warning-the black bar safety net

NetCms website management system upload vulnerability and fix Vulnerabilities Web application:NetCms website management system Vulnerability in the file the website registration address:/user/login. aspx 1. First of all, we in the Baidu or Google searchkeywords: “NetCms site management system” ! ...

Localize: HTML Form Without CSRF protection

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Vulnerable Form- http://www.localize.io/ Form inputs:...

Hacker stole $100,000 from Users of California based ISP using SQL Injection

In 2013 we have seen a dramatic increase in the number of hack attacks attempted against banks, credit unions and utility companies using various techniques including DDoS attack, SQL injection, DNS Hijacking and Zero-Day Flaws. SQL Injection is one of the most common security vulnerabilities on...

Hacker stole $100,000 from Users of California based ISP using SQL Injection

In 2013 we have seen a dramatic increase in the number of hack attacks attempted against banks, credit unions and utility companies using various techniques including DDoS attack, SQL injection, DNS Hijacking and Zero-Day Flaws. SQL Injection is one of the most common security vulnerabilities on...

[IronWASP v0.9.6.5] Open Source Advanced Web Security Testing Platform

IronWASP Iron Web application Advanced Security testing Platform is an open source system for web application vulnerability testing. It is designed to be customizable to the extent where users can create their own custom security scanners using it. Though an advanced user with Python/Ruby scripti...

et-chat - Privilege Escalation Arbitrary File Upload

et-chat - Privilege Escalation Arbitrary File Upload source: https://www.securityfocus.com/bid/60660/info et-chat is prone to a privilege-escalation vulnerability and an arbitrary shell-upload vulnerability. An attacker can exploit these issues to gain elevated privileges within the application a...

osCMax 2.5 - adminstats_customers.php?sorted Cross-Site Scripting

osCMax 2.5 - adminstatscustomers.php?sorted Cross-Site Scripting source: https://www.securityfocus.com/bid/52886/info osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiti...

Call for Paper - DEF CON Rajasthan March 2012 Meet

Call for Paper - DEF CON Rajasthan March 2012 Meet DEF CON Rajasthan - March 2012 Jaipur Meet, Call For Papers is now officially Open and will close on March 10, 2012. DEF CON Rajasthan DC91141 is a DEF CON Registered group of people interested in exploring technology and it implications in...

WAVSEP 1.0.3 – Web Application Vulnerability Scanner Evaluation Project

WAVSEP 1.0.3 – Web Application Vulnerability Scanner Evaluation Project A vulnerable web application designed to help assessing the features, quality and accuracy of web application vulnerability scanners. This evaluation platform contains a collection of unique vulnerable web pages that can be...

20 Famous websites vulnerable to Cross Site Scripting (XSS) Attack

20 Famous websites vulnerable to Cross Site Scripting XSS Attack Most of the biggest and Famous sites are found to be Vulnerable to XSS attack . Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web...

HP/HPE System Management Homepage (SMH) Insight Diagnostics XSS Vulnerability (HPSBMA02615) - Active Check

HP/HPE System Management Homepage SMH with Insight Diagnostics is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PHPortfolio 'photo.php' SQL Injection Vulnerability

PHPortfolio is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Preemptive Protection against LizaMoon - Mass SQL Injection Attacks

LizaMoon is a mass SQL code injection attack, where a Web application vulnerability is exploited to inject malicious code into affected websites. If a Web surfer visits an infested site, he will be redirected to an alternate website that tries to install a rogue anti-malware software. This...

Advanced Image Hosting 2.2 SQL Injection

========================================== Advanced Image Hosting v2.2 SQLi Vulnerability ========================================== InformatioN Title : Advanced Image Hosting v2.2 SQLi Vulnerability Author : keracker Vendor or Software Link : http://yabsoft.com Email : [email protected] Data :...

Moodle 'PHPCOVERAGE_HOME' Cross Site Scripting Vulnerability

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross- site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker m...