56796 matches found
Joomla Component Contact Info 1.0 - SQL Injection Vulnerability
No description provided by source. Joomla comcontactinfocatid SQL-injection vulnerability Author : boom3rang Kosova Hackers Group www.khg-crew.ws Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1. ! ModuleName: comcontactinfo ! ScriptName: Joomla ! GoogleDork:...
Exceed 5.0/6.0/6.1/7.1/8.0 Font Name Handler Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8194/info The Exceed server and client have been reported prone to a remotely triggered buffer overflow vulnerability. An attacker may trigger this vulnerability by sending excessive data as a font name to the server via ...
Online Photo Pro 2.0 'section' Parameter Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/34625/info Online Photo Pro is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site...
Linux-PAM 0.77 Pam_Wheel Module getlogin() Username Spoofing Privileged Escalation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7929/info A vulnerability has been discovered in the Linux-Pam pamwheel module. The problem exists in the way the module authenticates users under certain configurations. Specifically, if the module is configured to allow...
mongoose web server 2.11 - Directory Traversal vulnerability
No description provided by source. Exploit Title: Mongoose 2.11 Directory Traversal Date: 29 Oct Author: nitr0us Alejandro Hernandez H. Software Link: http://mongoose.googlecode.com/files/mongoose-2.11.exe Version: 2.11 Windows Version Tested on: Windows XP Service Pack 2 Chatsubo inSecurity Dark...
Joomla Component Archery Scores (com_archeryscores) 1.0.6 - LFI Vulnerability
No description provided by source...
AT 3.1.8 - Formatted Time Heap Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3886/info at is a freely available, open source scheduler package. It is included with various Unix and Linux operating systems, and maintained by public domain. Under some circumstances, at does not correctly handle time...
Apache + PHP 5.x (< 5.3.12 & < 5.4.2) - Remote Code Execution
No description provided by source. !/usr/bin/env python ap-unlock-v2.py - apache + php 5. rem0te c0de execution 0day better version NOTE: - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE : - for connect back shell start netcat/nc and bind port on given host:port - is ip-range scanner not is...
FreeWebshop 2.2.9 R2 Multiple Remote Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/37513/info FreeWebshop is prone to multiple remote vulnerabilities: 1. A security vulnerability that may allow attackers to spoof HTTP headers. 2. A security vulnerability involving the handling of sessions. 3. A security...
Google Chrome 8.0.552.237 - address overflow DoS
No description provided by source. html head Title: Google Chrome v8.0.552.237 address overflow DoS CVE-ID: OSVDB-ID: Author: Vuk Ivanovic Published: 2011-01-17 Verified: yes Google Chrome v8.0.552.237 address overflow DoS Tested on: Windows XP, SP2 EN, Windows 7 x64 Date tested: 01/16/2011...
Science Fair In A Box - SQLi & XSS Vulnerability
No description provided by source...
Avaya Cajun P130/P133/P330/P333 Network Switch Connection Stalling Denial of Service
No description provided by source. source: http://www.securityfocus.com/bid/7961/info It has been reported that Cajun switches do not properly handle traffic to port 4000. Because of this, an attacker may be able to cause the switch to stall for period of time. The following proof of concept stri...
YaSoft Switch Off 2.3 swnet.dll Remote Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/9340/info A vulnerability has been identified in the YaSoft Switch Off software package when handling message requests. The buffer overrun condition exists in the 'swnet.dll' module of the software due to insufficient...
Active News Manager LOGIN.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13759/info Active News Manager is prone to an SQL injection vulnerability. This issue affects the 'login.asp' script. Successful exploitation could result in a compromise of the application, disclosure or modification of...
e107 CMS 0.7 - Multiple Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/28917/info e107 CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the...
Linux Kernel 2.5.x/2.6.x CPUFreq Proc Handler Integer Handling Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10201/info A local integer handling vulnerability has been announced in the Linux kernel. It is reported that this vulnerability may be exploited by an unprivileged local user to obtain kernel memory contents. Additionall...
TradeMC E-Ticaret SQL and XSS Multiple Vulnerabilities
No description provided by source...
Dell SonicWall EMail Security Appliance Application 7.4.5 - Multiple Vulnerabilities
No description provided by source...
Juniper Junos 8.5/9.0 J-Web Interface /scripter.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/36537/info Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web Juniper Web Management. Attacker-supplie...
ClipBucket 1.7 'dwnld.php' Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that cou...
Opera Web Browser 7 IFRAME Zone Restriction Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8887/info A flaw in the Opera web browsers security model has been discovered that could allow an attacker to access a users filesystem within the Local Zone. The problem occurs when handling malformed HTML iframes which...
DMXReady Secure Login Manager 1.0 members.asp sent Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/21788/info DMXReady Secure Login Manager is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could...
ghttpd 1.4 Daemon Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2879/info ghttpd is a freely available, open source web server for Unix systems. ghttpd supports CGI and is easy to configure and use. A buffer overflow is known to exist in ghttp which will allow arbitrary code to be...
Kentico CMS 7.0.75 - User Information Disclosure
No description provided by source. Exploit Title: Kentico CMS User Enumeration Bug Google Dork: inurl:/CMSPages/logon.aspx -- enumerates several Kentico CMS sites Date: 02-25-2014 Exploit Author: Charlie Campbell and Lyndon Mendoza Vendor Homepage: http://www.kentico.com/ Software Link:...
Xbtit 2.0.0 - SQL Injection Vulnerability
No description provided by source. Title : Xbtit SQL Injection Vulnerability Author : Ctacok Homepage : http://ctacok.ru/ Vulnerable File : /index.php?page=users&order=SQL&by=ASC ExploiT :...
gdm 1.0 .x/2.0 .x BETA/2.2 .0 XDMCP Buffer Overflow Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/1233/info A buffer overrun exists in the XDMCP handling code used in 'gdm', an xdm replacement, shipped as part of the GNOME desktop. By sending a maliciously crafted XDMCP message, it is possible for a remote attacker to...
SugarCRM 1.x/2.0 Module record Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/11740/info SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL...
Linux Kernel 2.6.x 'posix-timers.c' NULL Pointer Dereference Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/35976/info The Linux kernel is prone to a local denial-of-service vulnerability. Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attacker...
Alisveristr E-commerce Login Multiple SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/15699/info Alisveristr E-commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successf...
Copy to WebDAV 1.1 iOS - Multiple Vulnerabilities
No description provided by source...
MyPHPim Login Page pass Field SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/16210/info MyPhPim is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabilities cou...
Miro Broadcast Machine 0.9.9 Login.PHP Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/26407/info Miro Broadcast Machine is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script...
Pheap 2.0 Config.PHP Pheap_Login Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/24227/info Pheap is prone to an authentication-bypass vulnerability due to a design error. An attacker can exploit this vulnerability to bypass authentication and execute arbitrary commands in the context of the site...
HR Assist <= 1.05 (vdateUsr.asp) Remote Login ByPass Vulnerability
No description provided by source. Title : HR Assist = 1.05 vdateUsr.asp Remote Login ByPass SQL Injection Author : ajann Page : http://www.ezhrs.com Contact : : $$$ : $45 Example: http://target/path/ UserName: ' union select 0,0,0,0,0,0,0,0,0,0,0,0,0 from admin ajann,Turkey ... Im not Hacker!...
DaLogin Multiple Vulnerabilities
No description provided by source. dalogin 2.2 multiple vulnerabilites app desc: Configurable WebSite. PHP + Mysql: news zone with rss feed, private zone, languages, themes, administration panel app source: http://dalogin.sourceforge.net/ author: hc0 1 config file disclosure you can access...
BibORB 1.3.2 Login Module Multiple Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/12583/info BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML...
ManageEngine Security Manager Plus <= 5.5 build 5505 Remote SYSTEM SQLi (MSF)
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...
TaskDriver <= 1.2 Login Bypass/SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w TaskDriver = 1.2 Login Bypass/SQL Injection Exploit Discovered by: Silentz Payload: Login Bypass & Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code login.php: $sql = SELECT FROM $userstable WHERE username =...
IBM Tivoli Identity Manager 5.0.5 User Profile HTML Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36293/info IBM Tivoli Identity Manager is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied...
Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities
No description provided by source...
VideoDB 3.0.3 'login.php' Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/38155/info VideoDB is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...
Flip <= 3.0 Remoe Admin Creation Exploit
No description provided by source. !/usr/bin/perl use strict; use IO::Socket; use Getopt::Std; my $app = Flip = 3.0; my $type = Admin Creation; my $author = undefined1; my $vendor = http://sourceforge.net/projects/flipsource; my %opt; getoptst:, %opt; $| = 1; print :: $app $type - by $author -...
XOOPS 'badliege' Module - 'id' Parameter SQL Injection Vulnerability
XOOPS 'badliege' Module - 'id' Parameter SQL Injection Vulnerability 1.漏洞信息 XOOPS 'badliege'模块是一款基于PHP的WEB应用程序。 XOOPS 'badliege'模块不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的'id'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 2. 测试方法...
Linux Kernel utrace and ptrace Local Denial of Service Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/29945/info The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition. Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users...
ASPNuke 0.80 register.asp Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/14062/info ASPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to...
DMXReady Secure Login Manager 1.0 applications/SecureLoginManager/inc_secureloginmanager.asp sent Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/21788/info DMXReady Secure Login Manager is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could...
SynConnect PMS (index.php, loginid param) - SQL Injection Vulnerability
No description provided by source. Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ====== Synchroweb...
Invision Power Board <= 1.3.1 Login.PHP SQL Injection (working)
No description provided by source. ?php / = 1.3.1 Final /str0ke / $server = SERVER; $port = 80; $file = PATH; $target = 81; / User id and password used to fake-logon are not important. '10' is a random number. / $id = 10; $pass = ; $hex = 0123456789abcdef; for$i = 1; $i = 32; $i++ $idx = 0; $foun...
IBD Micro CMS 3.5 - 'microcms-admin-login.php' Multiple SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/29159/info IBD Micro CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...
Xoops 2.0.5 NewList.PHP Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20927/info Xoops is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...