Updated 06_23_2014

files.csv

@@ -30471,5 +30471,13 @@ id,file,description,date,author,platform,type,port
 33820,platforms/php/webapps/33820.txt,"PotatoNews 1.0.2 'nid' Parameter Multiple Local File Include Vulnerabilities",2010-04-07,mat,php,webapps,0
 33821,platforms/php/webapps/33821.html,"n-cms-equipe 1.1c.Debug Multiple Local File Include Vulnerabilities",2010-02-24,ITSecTeam,php,webapps,0
 33822,platforms/hardware/webapps/33822.sh,"D-link DSL-2760U-E1 - Persistent XSS",2014-06-21,"Yuval tisf Nativ",hardware,webapps,0
-33823,platforms/php/webapps/33823.txt,"Wordpress 3.9.1 - CSRF vulnerabilities",2014-06-21,"Avinash Thapa",php,webapps,0
+33823,platforms/php/webapps/33823.txt,"Wordpress 3.9.1 - CSRF Vulnerability",2014-06-21,"Avinash Thapa",php,webapps,0
 33824,platforms/linux/local/33824.c,"Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid)",2014-06-21,"Vitaly Nikolenko",linux,local,0
+33825,platforms/asp/webapps/33825.txt,"Ziggurat Farsi CMS 'id' Parameter Unspecified Cross Site Scripting Vulnerability",2010-04-15,"Pouya Daneshmand",asp,webapps,0
+33826,platforms/linux/remote/33826.txt,"TCPDF  4.5.036/4.9.5 'params' Attribute Remote Code Execution Weakness",2010-04-08,apoc,linux,remote,0
+33827,platforms/php/webapps/33827.txt,"Istgah For Centerhost 'view_ad.php' Cross-Site Scripting Vulnerability",2010-04-07,indoushka,php,webapps,0
+33829,platforms/windows/remote/33829.c,"WinSoftMagic Photo Editor PNG File Buffer Overflow Vulnerability",2010-04-09,eidelweiss,windows,remote,0
+33832,platforms/php/webapps/33832.txt,"TANDBERG Video Communication Server 4.2.1/4.3.0 Multiple Remote Vulnerabilities",2010-04-12,"Jon Hart",php,webapps,0
+33833,platforms/php/webapps/33833.txt,"Blog System 1.x Multiple Input Validation Vulnerabilities",2010-04-12,"cp77fk4r ",php,webapps,0
+33834,platforms/php/webapps/33834.txt,"Vana CMS 'filename' Parameter Remote File Download Vulnerability",2010-04-13,"Pouya Daneshmand",php,webapps,0
+33835,platforms/php/webapps/33835.txt,"AneCMS 1.0 Multiple Local File Include Vulnerabilities",2010-04-12,"AmnPardaz Security Research Team",php,webapps,0

platforms/asp/webapps/33825.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/39311/info
+
+Ziggurat Farsi CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+http://www.example.com/index.asp?id=<script>("xss")</script>

platforms/linux/remote/33826.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/39315/info
+
+TCPDF is prone to a security weakness that may allow attackers to execute arbitrary code.
+
+An attacker can exploit this issue in conjunction with other latent vulnerabilities to execute arbitrary code with the privileges of the webserver.
+
+Versions prior to TCPDF 4.9.006 are vulnerable. 
+
+<tcpdf method="Rect" params=");echo `id`;die(" /> 

platforms/php/webapps/33827.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/39330/info
+
+Istgah for Centerhost is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks. 
+
+http://www.example.com/Istgah/view_ad.php?id=/"&#039;><ScRiPt>alert(213771818860)</ScRiPt>

platforms/php/webapps/33832.txt

@@ -0,0 +1,13 @@
+source: http://www.securityfocus.com/bid/39389/info
+
+TANDBERG Video Communication Server is prone to multiple remote vulnerabilities, including:
+
+1. A file-disclosure vulnerability.
+2. A security vulnerability that may allow attackers to conduct server impersonation and man-in-middle attacks.
+3. An authentication-bypass vulnerability.
+
+An attacker can exploit these issues to gain unauthorized access to the affected device and to gain access to sensitive information. Other attacks are also possible.
+
+Firmware versions prior to TANDBERG Video Communication Server 5.1.1 are vulnerable. 
+
+https://www.example.com/helppage.php?page=../../../../etc/passwd%00 

platforms/php/webapps/33833.txt

@@ -0,0 +1,10 @@
+source: http://www.securityfocus.com/bid/39406/info
+
+Blog System is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include local file-include, SQL-injection, and cross-site-scripting issues.
+
+Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view local files within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
+
+Blog System versions 1.5 and prior are affected. 
+
+http://www.example.com/ADMIN/index.php?category=(home|comments|lists|habillage|info)&action=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
+http://www.example.com/ADMIN/index.php?category=(home|comments|lists|habillage|info)&action=[LFI]%00 

platforms/php/webapps/33834.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/39415/info
+
+Vana CMS is prone to a vulnerability that lets attackers download arbitrary files. The issue occurs because the application fails to sufficiently sanitize user-supplied input.
+
+Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks 
+
+http://www.example.com/download.php?filename=File.php 

platforms/php/webapps/33835.txt

@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/39416/info
+
+AneCMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker can exploit these vulnerabilities to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
+
+AneCMS 1.0 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/rss.php?module=../.htaccess%00
+http://www.example.com/index.php?ajax=../../.htaccess%00
+