25 matches found
Nodes Studio CMS XSS / Path Disclosure / SQL Injection
Hello list! There are SQL Injection, Cross-Site Scripting and Full Path Disclosure vulnerabilities in Nodes Studio CMS. This is Russian commercial CMS, which I found at one site of Russian terrorists and propagandists. ------------------------- Affected vendors: ------------------------- Nodes...
D-Link DCS-2103 Brute Force / Cross Site Scripting
Hello list! There are Brute Force and Cross-Site Scripting vulnerabilities in D-Link DCS-2103 IP camera. If previous Path Traversal and Full path disclosure vulnerabilities were post-auth, then these BF and XSS vulnerabilities are pre-auth. ------------------------- Affected products:...
D-Link DAP-1360 Abuse / Cross Site Request Forgery
Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This mod...
BF and XSS vulnerabilities in Zyxel P660RT2 EE
Hello 3APA3A! These are Brute Force and Cross-Site Scripting vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with other firmware...
D-Link DAP 1150 Cross Site Request Forgery / Cross Site Scripting
Hello list! In 2011 and beginning of 2012 I wrote about multiple vulnerabilities http://securityvulns.ru/docs27440.html, http://securityvulns.ru/docs27677.html, http://securityvulns.ru/docs27676.html in D-Link DAP 1150 several dozens. That time I wrote about vulnerabilities in admin panel in Acce...
URL Redirector Abuse and XSS vulnerabilities in WordPress
Hello 3APA3A! As I've announced earlier http://seclists.org/fulldisclosure/2013/Nov/219, I conducted a Day of bugs in WordPress 3. At 30.11.2013 I disclosed many new vulnerabilities in WordPress. I've disclosed 10 holes they were placed at my site for your attention. And this is translation of th...
Uploadify 2.1.4 File Upload / XSS / File Deletion
Hello list! These are Arbitrary File Uploading, Arbitrary File Deletion and Cross-Site Scripting vulnerabilities in Uploadify. Particularly in the version used in aCMS it looks like these developers use modified version of Uploadify, but other developers also can use such version...
AFU vulnerabilities in MCImageManager for TinyMCE
Hello 3APA3A! I want to warn you about vulnerabilities in Moxiecode Image Manager MCImageManager. This is commercial plugin for TinyMCE. It concerns as MCImageManager, as all web applications which have MCImageManager in their bundle. These are Arbitrary File Uploading vulnerabilities, which lead...
WordPress Slash Theme XSS / Spoofing / Disclosure Vulnerabilities
The Slash theme for WordPress suffers from cross site scripting, content spoofing, and path disclosure vulnerabilities. Hello list! I want to warn you about multiple vulnerabilities in Slash WP theme for WordPress. This is commercial theme for WP. These are Full path disclosure, Cross-Site...
DoS vulnerability in Internet Explorer (access violation)
Hello 3APA3A! I want to warn you about Denial of Service vulnerabilities in Internet Explorer. This is access violation. I've made the exploit and tested this vulnerability at 13.02.2013. This exploit is based on video by TheSecuritylab for IE7. As I've tested, it also works in IE6 and IE8...
WordPress Organizer 1.2.1 XSS / CSRF / Shell Upload
Hello list! I want to warn you about multiple security vulnerabilities in plugin Organizer for WordPress. This is the second in series of advisories concerning vulnerabilities in this plugin. These are Cross-Site Scripting reflected and persistent, Cross-Site Request Forgery and Arbitrary File...
Joomla Bookman Denial Of Service
Hello list! I want to warn you about Insufficient Anti-automation and Denial of Service vulnerabilities in combookman for Joomla. Also this component is included in Reservation Manager for Joomla. This is another one of few advisories which I've made in April 2010. In this advisory I'm continue t...
New DoS, CSRF and XSS vulnerabilities in ADSL modem Callisto 821+
Hello 3APA3A! I want to warn you about new security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Denial of Service, Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. In April I've already drew attention of Ukrtelecom's representative and thi...
CSRF vulnerabilities in ADSL modem Callisto 821+
Hello 3APA3A! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Cross-Site Request Forgery vulnerabilities. In April I've already drew attention of Ukrtelecom's representative and this modem was bough at Ukrtelecom about multiple...
CSRF and XSS vulnerabilities in ADSL modem Callisto 821+
Hello 3APA3A! I want to warn you about security vulnerabilities in ADSL modem Callisto 821+ SI2000 Callisto821+ Router. These are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities. These attacks should be conducted on modem owner, which is logged into control panel. Taking into...
FPD и XSS уязвимости в Easy Contact для WordPress
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Cross-Site Scripting уязвимостях в плагине Easy Contact для WordPress. Full path disclosure WASC-13: http://site/wp-content/plugins/easy-contact/econtact.php http://site/wp-content/plugins/easy-contact/econtact-menu.php XSS...
Cetera eCommerce 14.0 Cross Site Scripting / SQL Injection
Hello list! I want to warn you about Cross-Site Scripting, SQL Injection and SQL DB Structure Extraction vulnerabilities in Cetera eCommerce. It's engine for online shops. ------------------------- Affected products: ------------------------- Vulnerable are Cetera eCommerce 14.0 and previous...
sfWpCumulusPlugin For Symphony Cross Site Scripting
Hello list! I want to warn you about Cross-Site Scripting vulnerability in plugin sfWpCumulusPlugin for symfony. ------------------------- Affected products: ------------------------- Vulnerable are all versions of sfWpCumulusPlugin. ---------- Details: ---------- This XSS is similar to XSS...
MC Content Manager Cross Site Scripting
Hello list! I want to warn you about Cross-Site Scripting vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are previous versions of MC Content Manager before version v.10.1.1. ---------- Details...
Многочисленные уязвимости в Firebook
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Information Leakage, Brute Force и Cross-Site Scripting уязвимостях в Firebook. Information Leakage WASC-13: http://site/cgi-bin/firebook/firebook.cgi На странице есть раздел SystemInfo с Full path disclosure и именами txt-файлов БД веб приложения...