The vulnerability exists due to insufficient sanitisation of user-supplied data passed to "/site/index.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database. The vulnerability also exists due to insufficient validation of the HTTP request origin. A remote attacker can create a malicious web page with CSRF explot code and trick a logged-on user to visit it.
When performing POST requests to /user/browse/view_/, the "search[gender]" and "search[sort_by]" parameters are not correctly sanitized before being used to construct SQL queries, making them vulnerable to Blind SQL Injection attacks.
This module exploits a vulnerability found on Firefox 17.0.6, specifically an use after free of a DocumentViewerImpl object, triggered via an specially crafted web page using onreadystatechange events and the window.stop() API, as exploited in the wild on 2013 August to target Tor Browser users.
It is possible to inject UTF-7 encoded XSS payload to the SuperScan 4.0 generated port scan report, through a specially crafted server response. XSS exploitation of McAfee SuperScan 4.0 can be automated with the Portspoof software.
When using the "category" view, the component does not correctly sanitize the "filter_order" and "filter_order_Dir" parameters before using them to construct SQL queries, making it vulnerable to SQL Injection attacks. In order to exploit these vulnerabilities, an attacker could perform requests like the following ones: For the "filter_order" parameter: POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y filter_title=&filter_content=&limit=0§ionid=20&filter_order=1 limit 1 offset 10000) union all (select 1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from dual)%23&filter_order_Dir=DESC For the "filter_order_Dir" parameter: POST /index.php?option=com_sectionex&view=category&id=X&Itemid=Y filter_title=&filter_content=&limit=0§ionid=20&filter_order=1&filter_order_Dir=DESC limit 1 offset 10000) union all (select 1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16 from dual)%23
The summary field in Usernoise is vulnerable to persistent cross site scripting, and the affected area is the Wordpress admin dashboard. The reason why this vulnerability exists is because the user input is not being properly handled when a feedback is submitted. It accepts any type of arbitrary code, including JavaScript, and when the content is displayed in the feedback section in the dashboard, all JavaScript code is executed causing a sever vulnerability with administrators as the target.
Multiple vulnerabilities have been found in Hikvision IP camera DS-2CD7153-E [1] (and potentially other cameras sharing the affected firmware [2]) that could allow a remote attacker: 1. [CVE-2013-4975] To obtain the admin password from a non-privileged user account. 2. [CVE-2013-4976] To bypass the anonymous user authentication using hard-coded credentials (even if the built-in anonymous user account was explicitly disabled). 3. [CVE-2013-4977] To execute arbitrary code without authentication by exploiting a buffer overflow in the RTSP packet handler.
Abusing authentication bypass in combination with a directory traversal to grab the sam file for offline cracking
A vulnerability exists in the WordPress Booking Calendar plugin version 4.1.4, which allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can add or delete bookings by sending a malicious POST request to the vulnerable application. The POST request contains the action to be performed, such as 'INSERT_INTO_TABLE' or 'DELETE_BY_ID', and the parameters required for the action.
The registration code field in the 'activate license' window is vulnerable to a buffer overflow. This script generates a malicious registry file. Once the generated file has been loaded into the registry, execute the application as normal.
Services By CQR