Zarafa WebApp Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

FlatNuke 3.1.x Cross Site Scripting

------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------...

FlatNuke <= 3.1.x BBCode IMG Tag Script Injection Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + FlatNuke = 3.1.x viewnews BBCode IMG Tag Script Injection PoC ------------------------------------------------------------------------- Discovered by Juri Gianni -...

FlatNuke 3.1.4 (FlatPoll) Persistent XSS Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------ 0day.today...

CVE-2014-5447

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions 644 for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103...

CVE-2014-5449

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data...

CVE-2014-5447

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions 644 for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103...

CVE-2014-5449

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data...

Design/Logic Flaw

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions 644 for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103...

Design/Logic Flaw

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data...

CVE-2014-5447

Technical details for CVE-2014-5447 are not publicly available in the provided documents. No concrete exploit vectors or affected versions are disclosed here; monitor for updates.

CVE-2014-5449

CVE-2014-5449 affects Zarafa WebAccess 4.1 and WebApp, where files in the tmp directory used world-readable permissions allowed local users to read temporary session data. The connected advisory set confirms multiple permission issues and includes CVEs 2014-0103, 2014-5447, 2014-5448, 2014-5449, ...

CVE-2014-5449

Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data...

CVE-2014-5447

Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions 644 for config.php, which allows local users to obtain sensitive information by reading the PHP session files. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103...

Air Transfer Iphone 1.3.9 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Air Transfer Iphone v1.3.9 -Remote crash, Broken Authentication file download and Memo Access. Date: 08/23/2014 Author: Samandeep Singh SaMaN - @samanL33T Vendor Homepage:http://www.darinsoft.co.kr/subhtmls/airtransferguide.html...

Air Transfer Iphone 1.3.9 - Multiple Vulnerabilities

Air Transfer Iphone 1.3.9 - Multiple Vulnerabilities Exploit Title: Air Transfer Iphone v1.3.9 -Remote crash, Broken Authentication file download and Memo Access. Date: 08/23/2014 Author: Samandeep Singh SaMaN - @samanL33T Vendor Homepage:http://www.darinsoft.co.kr/subhtmls/airtransferguide.html...

CVE-2014-0103

CVE-2014-0103 affects Zarafa WebAccess (and WebApp) prior to version 7.1.10 / 1.6, where credentials are stored in cleartext in PHP session files. This enables local Apache users to read sensitive information. OpenVAS advisories link CVE-2014-0103 to multiple Zarafa updates; Fedora/MGASA advisori...

WordPress NextGEN Gallery 2.0.63 Shell Upload Vulnerability

WordPress NextGEN Gallery plugin version 2.0.63 suffers from a remote shell upload vulnerability. Exploit Title: Wordpress NextGEN Gallery Plugin 2.0.63 Arbitrary File Upload Author: SANTHO @s4n7h0 Vendor Homepage: http://wordpress.org/plugins/nextgen-gallery/ Category: WebApp / CMS / Wordpress...

WordPress NextGEN Gallery 2.0.63 Shell Upload

Exploit Title: Wordpress NextGEN Gallery Plugin 2.0.63 Arbitrary File Upload Author: SANTHO @s4n7h0 Vendor Homepage: http://wordpress.org/plugins/nextgen-gallery/ Category: WebApp / CMS / Wordpress Version: 2.0.63 and less --------------------------------------------------- Vulnerability Tracking...

T-Dreams Cars Ads Package 2.0 - SQL Injection

No description provided by source. Author: R4dc0re Exploit Title: T-Dreams Cars Ads Package SQL injection Vulnerability Date: 04-12-2010 Vendor or Software Link:http://t-dreams.com Category:WebApp Version:2.0 Price:31$ Contact: [email protected] Website: www.1337db.com Greetings to:...