Joomla VXDate SQL Injection / Cross Site Scripting

Hello Bugtraq! I want to warn you about vulnerabilities in component VXDate for Joomla. ----------------------------- Advisory: Vulnerabilities in VXDate for Joomla ----------------------------- URL: http://websecurity.com.ua/3849/ ----------------------------- Timeline: 10.05.2009 - found the...

Brute Force and Insufficient Authorization vulnerabilities in WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Brute Force и Insufficient Authorization уязвимостях в WordPress. Ранее в 2008 году я уже писал о Brute Force уязвимости в WordPress http://websecurity.com.ua/2007/, что была выявлена Kad ещё в 2007 году http://securityvulns.ru/Pdocument580.html...

Abton CMS SQL Injection

Hello Full-Disclosure! I want to warn you about vulnerabilities in Abton. It's commercial Ukrainian CMS. ----------------------------- Advisory: Vulnerabilities in Abton ----------------------------- URL: http://websecurity.com.ua/2886/ ----------------------------- Timeline: 31.03.2008 - found t...

Hydra CMS SQL Injection / Cross Site Scripting

Hello Full-Disclosure! I want to warn you about vulnerabilities in Hydra Engine. It's commercial Ukrainian CMS. ----------------------------- Advisory: Vulnerabilities in Hydra Engine ----------------------------- URL: http://websecurity.com.ua/3453/ ----------------------------- Timeline:...

Vulnerability in phpAdsNew, OpenAds and OpenX

Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting уязвимости в системах phpAdsNew, OpenAds та OpenX. В баннерных системах phpAdsNew, OpenAds и OpenX возможна XSS атака через параметр clickTAG во флеш баннерах. О подобных уязвимостях я писал в своей статье XSS уязвимости в 8 миллионах флеш...

XAMPP <= 1.6.8 Multiple Vulnerabilities (Jun 2009)

XAMPP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apachefriends:xampp"; if description...

Multiple vulnerabilities in XAMPP

No description provided by source. I am continue informing you about multiple vulnerabilities in XAMPP. ----------------------------- Advisory 7 ----------------------------- CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP ----------------------------- URL:...

Vulnerabilities in TYPO3

Hello 3APA3A! I want to warn you about security vulnerabilities in TYPO3. These are Cross-Site Scripting, Full path disclosure and Redirector vulnerabilities. XSS: http://site/index.php?id=49&sword=223E3Cscript3Ealertdocument.cookie3C/script3E...

Vulnerabilities in WP-Cumulus for WordPress

No description provided by source. These are Full path disclosure and Cross-Site Scripting vulnerabilities. Full path disclosure: http://site/wp-content/plugins/wp-cumulus/wp-cumulus.php XSS: http://site/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3 ...

Vulnerabilities in plugins for WordPress

Hello Bugtraq! I want to tell you about different vulnerabilities in plugins for WordPress. About some of them there were posts to the list earlier. This August I made a summary about all vulnerabilities in plugins for WordPress http://websecurity.com.ua/3397/, which I found during 2006-2009. In...

Vulnerabilities in Abton

Здравствуйте 3APA3A! Сообщаю вам о найденных мною SQL DB Structure Extraction и SQL Injection уязвимостях в Abton это украинская CMS. SQL DB Structure Extraction: http://site/rus/details/13220/ http://site/rus/referaty/’/ http://site/rus/’/ http://site/rus/referaty/1/-1/ http://site/abton/ SQL...

Vulnerabilities in SimpGB

Hello 3APA3A! I want to warn you about security vulnerabilities in SimpGB. These are Full path disclosure, Insufficient Anti-automation and Cross-Site Scripting vulnerabilities. Full path disclosure: http://site/admin/index.php?lang=1 http://site/admin/pwlost.php?lang=1...

Vulnerabilities in WP-Cumulus for WordPress

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Full path disclosure и Cross-Site Scripting уязвимостях в плагине WP-Cumulus для WordPress. Full path disclosure: http://site/wp-content/plugins/wp-cumulus/wp-cumulus.php XSS:...

DoS vulnerability in Internet Explorer

No description provided by source. html head titleInternet Explorer DoS Exploit C 2009 MustLive. http://websecurity.com.ua/title script function DoS document.getElementById"dos".click; setTimeoutDoS,1; /script /head body onload="DoS" div align="center"a id="dos" href=""...

DoS vulnerability in Internet Explorer

Hello Bugtraq! I want to warn you about Denial of Service vulnerability in Internet Explorer. Yesterday I already informed Microsoft. This attack I called DoS via homepage. DoS: http://websecurity.com.ua/uploads/2009/IE20DoS20Exploit10.html With this exploit in IE6 the browser blocks, so it's...

Vulnerabilities in Pigalle

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in Pigalle. These are Information Leakage, Full path disclosure and Cross-Site Scripting vulnerabilities. Information Leakage: http://site/index.php Versions of PHP, MySQL and web server are shown in meta-tags in source of a...

Cross-Site Scripting vulnerability in Joostina

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в Joostina CMS. Данная уязвимость подобна XSS уязвимости, которую я в 2007 году нашёл в Joomla 1.0.x. Но в отличии от Joomla, в Joostina нет ограничения на количество символов в строке поиска. Что позволяет...

Cross-Site Scripting vulnerability in eCaptcha

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in eCaptcha plugin for E107. I found this hole in July 2008 and disclosed it at 25.09.2008. XSS: POST query at page http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0 scriptalertdocument.cookie/script in field...

E107 eCaptcha Cross Site Scripting

Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in eCaptcha plugin for E107. I found this hole in July 2008 and disclosed it at 25.09.2008. XSS: POST query at page http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0 alertdocument.cookie in field: Type Here...

e107 eCaptcha plugin 2.1 xss

No description provided by source. Hello Bugtraq! I want to warn you about Cross-Site Scripting vulnerability in eCaptcha plugin for E107. I found this hole in July 2008 and disclosed it at 25.09.2008. XSS: POST query at page http://site/path/ecaptcha/?key=b7c9bf99e763252105f047a5ca5681d0...