[FD] ManageEngine OpManager multiple vulnerabilities

2015-09-15 Thread xistence
Exploit Title: ManageEngine OpManager multiple vulnerabilities Product: ManageEngine OpManager Vulnerable Versions: v11.5 and previous versions Tested Version: v11.5 (Windows) Advisory Publication: 14/09/2015 Vulnerability Type: hardcoded credentials, SQL query protection bypass Credit: xistence

[FD] ManageEngine EventLog Analyzer SQL query execution

2015-09-15 Thread xistence
Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 (Windows) Advisory Publication: 14/09/2015 Vulnerability Type: authenticated SQL query execution C

[FD] FuzzDB updated, relocated to Github

2015-09-15 Thread Adam Muntner
FuzzDB has moved to Github.- https://github.com/fuzzdb-project/fuzzdb - New and updated payload files - Easier to find payloads - Comments that were previously in payload files relocated to README.md files - Documentation and cheatsheets centralized in /docs Pull requests welcomed! _

[FD] [CVE-2015-5956] Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting

2015-09-15 Thread Ahrens, Julien
secunet Security Networks AG Security Advisory Advisory: Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting 1. DETAILS -- Product: Typo3 CMS Vendor URL: typo3.org Type:Cross-site Scripting[CWE-79] Date found: 2015-07-30 Date published: 2015-0

[FD] (0day) IBOOKING CMS - SQL INJECTION

2015-09-15 Thread INURL Brasil
*# VENTOR: * www.ibooking.com.br *# Vulnerable versions:* ALL *# File: *filtro_faixa_etaria.php *# Parameter: * idPousada(GET) *# DORK: * intext:"Desenvolvido por ibooking" *# Reported:* 15/10/2015 # --

[FD] Weeman 1.1 HTTP server for phishing | release announcement

2015-09-15 Thread Hypsurus
Hello list, Weeman 1.1 - is a simple HTTP server (Using python). The server will do the following steps: 1, will create a phishing page, 2, will grab the DATA take the user, 3, and will try to login the user to the original website. Tested only on linux. You will need to install python <=

[FD] Kirby CMS <= 2.1.0 Authentication Bypass via Path Traversal

2015-09-15 Thread Dawid Golunski
= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: Medium/High = I. VULNERABILITY - Kirby CMS <= 2.1.0 Authentication Bypass via Path Traversal II. BACKGROU

[FD] Kirby CMS <= 2.1.0 CSRF Content Upload and PHP Script Execution

2015-09-15 Thread Dawid Golunski
= - Release date: 14.09.2015 - Discovered by: Dawid Golunski - Severity: High = I. VULNERABILITY - Kirby CMS <= 2.1.0 CSRF Content Upload and PHP Script Execution II. BACKGROUND

[FD] ZeusCart 4.0: CSRF - not fixed

2015-09-15 Thread Curesec Research Team (CRT)
ZeusCart 4.0: CSRF Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: supp...@zeuscart.com Vulnerability Type: CSRF Remote Exploitable: Yes

[FD] ZeusCart 4.0: Code Execution - not fixed

2015-09-15 Thread Curesec Research Team (CRT)
ZeusCart 4.0: Code Execution Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: supp...@zeuscart.com Vulnerability Type: Code Execution Remote Explo

[FD] ZeusCart 4.0: SQL Injection - not fixed

2015-09-15 Thread Curesec Research Team (CRT)
ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: supp...@zeuscart.com Vulnerability Type: SQL Injection Remote Exploi

[FD] ZeusCart 4.0 - XSS - not fixed

2015-09-15 Thread Curesec Research Team (CRT)
ZeusCart 4.0: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: supp...@zeuscart.com Vulnerability Type: XSS Remote Exploitable: Yes

[FD] Zen Cart 1.5.4 - Code Execution and Information Leak

2015-09-15 Thread Curesec Research Team (CRT)
Zen Cart 1.5.4: Code Execution and Information Leak Security Advisory – Curesec Research Team 1. Introduction Affected Product: Zen Cart 1.5.4 Fixed in: partial fix via patch Partial Patch Link: https://www.zen-cart.com/showthread.php?218239-curesec-security-report-Patch-Incl

[FD] Anchor CMS 0.9.2 - XSS

2015-09-15 Thread Curesec Research Team (CRT)
Anchor CMS 0.9.2: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: Anchor CMS 0.9.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://anchorcms.com/ Vulnerability Type: XSS and Open Redire

[FD] Paypal Inc - Open Redirect Web Vulnerability

2015-09-15 Thread Vulnerability Lab
Document Title: === Paypal Inc - Open Redirect Web Vulnerability References (Source): http://www.vulnerability-lab.com/get_content.php?id=1598 Vulnerability Magazine: http://magazine.vulnerability-db.com/?q=articles/2015/09/11/paypal-inc-%C2%A0medium-severity-op