Virtualismi (prodotto.php?id) Cross Site Scripting Vulnerabilities

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Loop ricetta.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.loopmm.com/ Persian Gulf 4 Ever! Dork : "Loop - creazioni multimediali" "inurl:ricetta.php?id="...

XSS Ebuddy (responsible disclosure)

Early this morning, the security group Virtual Luminous published a vulnerability in 'Ebuddy Web Messenger' and we would like to inform you that this vulnerability had been discovered and reported to the vendor on June 5th, 2011 by DcLabs Security Research Group. In the report below you are going...

ZDI-11-279: (0day) Witness Systems eQuality Unify Remote Code Execution Vulnerability

ZDI-11-279: 0day Witness Systems eQuality Unify Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-279 September 2, 2011 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Nortel Witness Systems -- Affected Products: Nortel Contact Recording and Quali...

Abarkam (detail.php?input) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Abarkam detail.php?input AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.abarkam.com/ Persian Gulf 4 Ever! Dork : allinurl:"detail.php?input=" Exploite:...

ZDI-11-278: Novell Cloud Manager Insufficient Framework User Validation Vulnerability

ZDI-11-278: Novell Cloud Manager Insufficient Framework User Validation Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-278 September 2, 2011 -- CVE ID: CVE-2011-2654 -- CVSS: 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell eDirectory --...

Multiple XSS vulnerabilities in LightNEasy 3.2.4

Advisory: Multiple XSS vulnerabilities in LightNEasy Advisory ID: SSCHADV2011-013 Author: Stefan Schurtz Affected Software: 3.2.4 Vendor URL: http://www.lightneasy.org/ Vendor Status: informed CVE-ID: - ========================== Vulnerability Description: ========================== LightNEasy is...

Pranian Group e107 Cross Site Scripting Vulnerabilities

IRANIAN THE BEST HACKERS IN THE WORLD Cross Site Scripting Vulnerabilities Pranian Group e107 AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Persian Gulf 4 Ever! Dork : "by Pranian Group e107" Exploite:...

Cloud Manager unaurhozied access

Insufficient authentication in RPC-based service...

Loop (ricetta.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Loop ricetta.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.loopmm.com/ Persian Gulf 4 Ever! Dork : "Loop - creazioni multimediali" "inurl:ricetta.php?id="...

Witness Systems eQuality Unify buffer overflow

Buffer overflow on TCP/6821 packet parsing...

Microsoft Windows CSRSS DoS

NULL pointer dereference on console input from stdin if stderr and stdout are closed...

BvCom (dettaglio.php?idnews) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability BvCom dettaglio.php?idnews AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.bvcom.it/ Persian Gulf 4 Ever! Dork : "Powered by: bvcom.it" "inurl:dettaglio.php?idnews="...

WSTAFF Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability WSTAFF AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.wstaff.it/ Persian Gulf 4 Ever! Dork : "Powered by: WSTAFF srl" Exploite: www.victim.com/prodotti.php?codice=-5 uni...

[SECURITY] [DSA 2301-1] rails security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2301-1 [email protected] http://www.debian.org/security/ Luciano Bello September 5, 2011 http://www.debian.org/security/faq -...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Editel (news-dettaglio.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Editel news-dettaglio.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.editeltn.it/ Persian Gulf 4 Ever! Dork : "Realizzazione sito: Editel"...

Pranian Group e107 Cross Site Scripting Vulnerabilities

IRANIAN THE BEST HACKERS IN THE WORLD Cross Site Scripting Vulnerabilities Pranian Group e107 AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Persian Gulf 4 Ever! Dork : "by Pranian Group e107" Exploite:...

XSS in Zikula

Vulnerability ID: HTB23039 Reference: https://www.htbridge.ch/advisory/xssinzikula.html Product: Zikula Application Framework Vendor: Zikula Software Foundation http://zikula.org/ Vulnerable Version: 1.3.0, build 3168 and probably prior Tested Version: 1.3.0, build 3168 Vendor Notification: 17...

openvas 2.x race condition

openvas-server/openvas/ovalplugins.c ... resultsfilename = "/tmp/results.xml"; if gfiletest resultsfilename, GFILETESTEXISTS logwrite "Found existing results file in s, deleting it to avoid conflicts.", resultsfilename; it unlink /tmp/results.xml avoid symlink attack then spawn process that write...

openvas race conditions

Race conditions for symbolic link attack...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

CWM (dettaglio-prodotto.asp?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability CWM dettaglio-prodotto.asp?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.cynaskyweb.it/ Persian Gulf 4 Ever! Dork : "Powered by CWM" "inurl:dettaglio-prodotto.asp?id...

Sana Net (viewpages.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Sana Net viewpages.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.sana-net.com/ Persian Gulf 4 Ever! Dork : inurl:"viewpages.php?id=" " " Exploite:...

Full disclosure for SA45649, SQL Injection in LedgerSMB and SQL-Ledger

Affects versions: SQL-Ledger 2.8.33 and lower LedgerSMB 1.2.24 and lower. Both programs have vendor fixes available in the form of new, patched versions. These have been out for over a week with appropriate advisories, with users having time to upgrade. Files affected: LedgerSMB/RP.pm for LedgerS...

ph5gruppo (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability ph5gruppo prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.ph5gruppo.it/ Persian Gulf 4 Ever! Dork : "Sito realizzato da ph5 gruppo" Exploite:...

Vulnerabilities in BroadWin WebAccess Client 1.0.0.10

Luigi Auriemma Application: BroadWin WebAccess Client http://broadwin.com/Client.htm Versions: bwocxrun.ocx = 1.0.0.10 aka version 7.0 Platforms: Windows Bugs: A format string B arbitrary memory corruption Exploitation: remote Date: 02 Sep 2011 Author: Luigi Auriemma e-mail: [email protected]...

Mediagrafic (prodotto.asp?id) (records.asp?id_p) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Mediagrafic prodotto.asp?id records.asp?idp AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.mediagrafic.eu/ Persian Gulf 4 Ever! Dork : "Powered by Mediagrafic.it"...

[PT-2011-19] SQL injection vulnerability in Help Request System

---------------------------------------------------------------------- PT-2011-19 Positive Technologies Security Advisory SQL injection vulnerability in Help Request System ---------------------------------------------------------------------- --- Vulnerable software Help Request System Version...

KnFTPd FTP Server buffer overflows

Buffer overflows in different FTP commands...

Dexanet Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Dexanet AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.dexanet.com/ Persian Gulf 4 Ever! Dork : "inurl:competenzeprodotti.asp?id=" Exploite:...

Cisco Security Advisory: Denial of Service Vulnerability in Cisco TelePresence Codecs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Denial of Service Vulnerability in Cisco TelePresence Codecs Advisory ID: cisco-sa-20110831-tandberg Revision 1.0 For Public Release 2011 August 31 1600 UTC GMT...

Studio Linea (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Studio Linea prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.studiolinea.com/ Persian Gulf 4 Ever! Dork : "Designed by Studio Linea srl" Exploite:...

KnFTPd v1.0.0 Multiple Command Remote Buffer Overflow

KnFTPd FTP Server v1.0.0 is vulnerable to a buffer overflow caused by improper bounds checking. By sending an overly long request to Multpile FTP commandUSER,PASS,REIN,QUIT,PORT,PASV,TYPE,STRU,MODE,RETR,STOR,...

XSS in Redirection wordpress plugin

Vulnerability ID: HTB23038 Reference: https://www.htbridge.ch/advisory/xssinredirectionwordpressplugin.html Product: Redirection wordpress plugin Vendor: John Godley http://urbangiraffe.com Vulnerable Version: 2.2.8 and probably prior Tested Version: 2.2.8 Vendor Notification: 10 August 2011...

ZDI-11-277: Apple QuickTime 3g2 'mp4v' atom size Remote Code Execution Vulnerability

ZDI-11-277: Apple QuickTime 3g2 'mp4v' atom size Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-277 August 31, 2011 -- CVE ID: CVE-2011-0258 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Apple -- Affected Products: Apple QuickTime --...

Pc Web Agency (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Pc Web Agency prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.pcwebagency.it/ Persian Gulf 4 Ever! Dork : "Powered by Pc Web Agency"...

Secunia Research: InduSoft ISSymbol ActiveX Control Buffer Overflow Vulnerabilities

====================================================================== Secunia Research 01/09/2011 - InduSoft ISSymbol ActiveX Control Buffer Overflows - ====================================================================== Table of Contents Affected...

Symantec Veritas Backup Exec code execution

It's possible to execute privileged command remotely...

Sana Net (viewnews.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Sana Net viewnews.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.sana-net.com/ Persian Gulf 4 Ever! Dork : "inurl:viewnews.php?id=" " " Exploite:...

Fulci (prodotto.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability fulci prodotto.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.fulci.it/ Persian Gulf 4 Ever! Dork : "designed by fulci.it" "prodotto.php?id=" Exploite:...

BroadWin WebAccess Client ActiveX security vulnerabilities

Format string vulnerability, memory corruption...

Olonet (prodotto.php?idproduct) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Olonet prodotto.php?idproduct AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.olonet.net/ Persian Gulf 4 Ever! Dork : "Powered & designed by Olonet.net" Exploite:...

ITTWeb Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability ITTWeb AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.ittweb.net/ Persian Gulf 4 Ever! Dork : "Web Design By I.T.&T" "inurl:?id=" Exploite:...

Apple QuickTime multiple security vulnerabilities

Memory corruptions in PICT, JPEG2000, WAV, JPEG, GIF and different movie formats parsing, crossite scripting...

[security bulletin] HPSBUX02700 SSRT100506 rev.1 - HP-UX running VEA, Remote Denial of Service (DoS), Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02962262 Version: 1 HPSBUX02700 SSRT100506 rev.1 - HP-UX running VEA, Remote Denial of Service DoS, Execution of Arbitrary Code NOTICE: The information in this Security Bulletin should be acted...

EMC RSA enVision security vulnerabilities

Information leakage, unauthorized access...

Marketing & Development (prodotto.php?cat) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability Marketing & Development prodotto.php?cat AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.marketingdev.com Persian Gulf 4 Ever! Dork : "powered by Marketing & Development"...

Apache Tomcat information leakage and unauthorized access

A part of AJP message data may be processed as a new AJP message...

Cross-Site Scripting (XSS) in Microsoft ReportViewer Controls

================================================== Cross-Site Scripting XSS in Microsoft ReportViewer Controls Adam Bixby - Gotham Digital Science [email protected] Public Release Date: 8/9/2011 Confirmed Affected Software: Microsoft Report Viewer Redistributable 2005 SP1 and Microsoft Visual...

webyuss (prodotto.php?id) (quadri.php?id) Remote SQL injection Vulnerability

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability webyuss prodotto.php?id quadri.php?id AuTh0r : EhsanHp200 H0ME : www.ehsanhp.blogsky.com Email : [email protected] Vendor : http://www.webyuss.com/ Persian Gulf 4 Ever! Dork : "Powered by webyuss" "inurl:prodotto.php?id...