The KORA 2.7.0 web application is vulnerable to SQL Injection. An attacker can exploit this vulnerability by injecting malicious SQL queries into the 'cid' parameter of the 'assocSearch' action in the 'control.php' file. This can lead to unauthorized access to the database and potential data leakage.
Flatnuke doesn't use any database, so the registred users informations are located in a php file like /flatnuke3/misc/fndatabase/users/username.php . By the file manager module, the administrator, can upload, make, edit or delete some files, only while he's logging in. By the way, making a post whit the same request of that module, we can replace or edit a file, for example an user profile. So, there are a lot of way to exploit this vulnerability, we can edit the admin credentials, we can upload a malicious php script, and much more... But to exploit this vulnerability, we need to know the script path. We can get it generating a full path disclosure.
A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.
This script is a Perl implementation of a DNS reflection DDoS attack. It uses Net::DNS::Resolver and Net::RawIP modules to send DNS packets to open, recursive DNS servers. The attack involves spoofing the source IP address to that of the target, so that the responses from the DNS servers are directed towards the target, causing a flood of traffic.
This exploit takes advantage of a buffer overflow vulnerability in Snes9K version 0.0.9z. By pasting the contents of boom.txt into the Socket Port Number field under Netplay -> Options, an attacker can connect to the victim machine on port 4444. The exploit payload is a windows/shell_bind_tcp payload generated using msfvenom.
The FLIR AX8 thermal sensor camera suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed via the 'file' parameter in download.php is not properly verified before being used to download config files. This can be exploited to disclose the contents of arbitrary files via absolute path.
The FluxBB <= 1.5.6 version is vulnerable to SQL Injection. An attacker can manipulate the 'req_new_email' parameter in the 'change_email' action of the 'profile.php' page to inject SQL code into the database. This can lead to unauthorized access, data leakage, and other malicious activities.
The HaPe PKH 1.1 application allows arbitrary file upload, which can lead to remote code execution.
The administrator password can be changed
This bug causes a denial of service in Mozilla Firefox 2.0.0.7. It works by using two files, an HTML file and an XML file. The HTML file contains a script that triggers the bug and causes the browser to crash. The XML file contains a binding that is referenced by the script in the HTML file. When the script is executed, it triggers the binding in the XML file, which causes the browser to crash.
Services By CQR
