Upcoming Podcast: Python security projects

Join Coalfire penetration tester Dan McInerney on Thursday April 30th at 6:00pm ET on the Security Weekly Podcast...

CVE-2014-5682

The CVE-2014-5682 entry refers to The Retale - Weekly Ads & Deals (com.retale.android) for Android v2.1.3, where the app does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Connec...

Weekly Drawing Contest 0.0.1 Check_Vote.PHP Local File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22937/info Weekly Drawing Contest is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view local files on the...

rubygem-openshift-origin-node: cron.daily/cron.weekly denial of service

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly...

[ZAP] OWASP Zed Attack Proxy Weekly

The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration...

OWASP Hackademic Challenges Project

The OWASP Hackademic Challenges Project is an open source project that helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controlable and safe environment. On the left menu you can see all attack scenarios that are...

CVE-2010-0752

The weekpostpage function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors...

Sql injection

The weekpostpage function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors...

SA-CONTRIB-2010-019 - Weekly Archive by Node Type - Access Bypass

The Weekly Archive by Node Type module generates weekly archive pages and a block with links to the pages. You can specify the node types that will be included in the archive pages. In weekly summaries listings, the Weekly Archive by Node Type module does not construct its SQL query to respect no...

CVE-2006-7209

Multiple cross-site scripting XSS vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the 1 main, 2 daily, 3 weekly, 4 monthly, 5 new trends, 6 individual page, and 7 search engine...

Sql injection

SQL injection vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter...

Directory traversal

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1601

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1602

The CVE-2007-1602 entry describes an SQL injection vulnerability in check_vote.php of Weekly Drawing Contest 0.0.1. The vulnerability allows remote attackers to craft a request using the order parameter to execute arbitrary SQL commands, potentially compromising data confidentiality and integrity...

CVE-2007-1601

The CVE-2007-1601 entry concerns a directory traversal in Weekly Drawing Contest 0.0.1, where check_vote.php allegedly allows remote attackers to read arbitrary files via .. in the order parameter. The description also notes that another researcher disputes this vulnerability, stating that the or...

CVE-2007-1603

CVE-2007-1603 describes an authentication bypass in admin/contest.php of the Weekly Drawing Contest 0.0.1, enabling remote attackers to bypass login and insert new contest information via a direct POST request. The CVSS vector (AV:N/AC:L/Au:N/C:P/I:P/A:P) yields a base score of 7.5 (HIGH), indica...

CVE-2007-1601

Directory traversal vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the order parameter. NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows...

CVE-2007-1602

SQL injection vulnerability in checkvote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter...

PT-2007-2983 · Unknown · Weekly Drawing Contest

Name of the Vulnerable Software and Affected Versions: Weekly Drawing Contest version 0.0.1 Description: The issue allows remote attackers to potentially read arbitrary files via a .. dot dot in the order parameter in the check vote.php file. However, it is noted that another researcher disputes...

wdc-lfi.txt

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= Weekly Drawing Contest = checkvote.php Remote File Disclosure Vuln Script: Weekly Drawing Contest Version: 0.0.1 S!Te: http://www.hotscripts.com/jump.php?listingid=52638&jumptype=1 Discover: BorN To K!LL...