Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

vBulletin 4.2.2 Moderator Control Panel 4.2.2 CSRF Vulnerability

Exploit for php platform in category web applications This is private exploit. You can buy it at https://0day.today...

E-Journal Multiple Vulnerabilities

E-Journal suffer from SQL Injection and Privilege Escalation Vulnerability. ========================================================================================== E-Journal Multiple Vulnerabilities ==========================================================================================...

Microsoft Office Web Apps Remote Code Execution Vulnerabilities (3017301)

This host is missing a critical security update according to Microsoft Bulletin MS14-081. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SECURITY] Fedora 21 Update: stapler-1.233-1.fc21

Stapler is a library that "staples" your application objects to URLs, making it easier to write web applications. The core idea of Stapler is to automatically assign URLs for your objects, creating an intuitive URL hierarchy...

[SECURITY] Fedora 21 Update: mod_wsgi-4.3.2-1.fc21

The modwsgi adapter is an Apache module that provides a WSGI compliant interface for hosting Python based web applications within Apache. The adapter is written completely in C code against the Apache C runtime and for hosting WSGI applications within Apache has a lower overhead than using existi...

Yii Framwork CmsInput Improper XSS Filter

Yii framework CmsInput extension 1 improper XSS sanitation + Discovered by: Jos Wetzels + Affects: Yii framework CmsInput extension xssClean$this-stripTags$str; What happens is that stripTags is called on the user-supplied input before xssClean is called. stripTags is designed to eliminate all...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

[SECURITY] Fedora 19 Update: php-ZendFramework2-2.2.8-2.fc19

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

FastHealth.com CMS Open Redirect

URL Open Redirect on FastHealth.com CMS Risk: Low CWE number: CWE-601 Date: 04/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro ; Chrome 39.0.2171.42 beta-m Vulnerable File: goto.php Exploit: + http://www.FastHealth.com/goto.php?url=http://site.com PoC...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

file: CDF property info parsing nelements infinite loop

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

IT Security Horror Story: Digging your own grave with Default Credentials

I recently performed a penetration test that really required no "hacking skills" whatsoever. I was able to obtain domain administrator rights simply by logging into web applications and network hardware using default credentials...

drchrono Electronic Health Record (EHR) web applications vulnerable to cross-site scripting and cross-site request forgery

Overview drchrono Electronic Health Record EHR web applications allow cross-site scripting XSS and cross-site request forgery CSRF that could allow an attacker to obtain sensitive patient information. Description drchrono provides an EHR web application service at drchrono.com, onpatient.com, and...

Arachni v1.0 - Web Application Security Scanner Framework

Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. It is smart, it trains itself by monitoring and learning from the web application's behavior during the scan...

MyBB MyBBlog 1.0 Cross Site Scripting

Title : MyBB MyBBlog 1.0 Plugin Cross Site Scripting Author : DevilScreaM Date : 24 October 2014 Category : Web Applications Vendor : https://github.com/JN-Jones/MyBBlog Download : http://community.mybb.com/mods.php?action=view&pid=221 Version : 1.0 Greetz : newbie-security.or.id | Borneo Securit...

Mozilla.org Cross Site Scripting

Domains: http://lxr.mozilla.org/ http://mxr.mozilla.org/ The two domains above are almost the same Websites information: lxr.mozilla.org, mxr.mozilla.org are cross references designed to display the Mozilla source code. The sources displayed are those that are currently checked in to the mainline...

Kayako Fusion Cross Site Scripting Vulnerability

Exploit for php platform in category web applications This is private exploit. You can buy it at https://0day.today...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...