webapps

WordPress Plugin CP Multi View Event Calendar 1.01 – SQL Injection

######################

WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form – Arbitrary File Upload

#!/usr/bin/python

Dell EqualLogic Storage – Directory Traversal

# Exploit Title: Remote Directory Traversal exploit for Dell EqualLogic 6.0

Magento Server MAGMI Plugin 0.7.17a – Remote File Inclusion

Exploit found date: 10/24/2014

Dell SonicWALL Gms 7.2.x – Code Injection

Document Title:

Axway Secure Transport 5.1 SP2 – Arbitrary File Upload (via Cross-Site Request Forgery)

Feng Office 1.7.4 – Cross-Site Scripting

source: https://www.securityfocus.com/bid/47049/info

Feng Office 1.7.4 – Arbitrary File Upload

import socket

DotNetNuke DNNspot Store 3.0.0 – Arbitrary File Upload (Metasploit)

# Exploit Title: DotNetNuke DNNspot Store (UploadifyHandler.ashx) windows/shell/reverse_tcp

File Manager 4.2.10 iOS – Code Execution

Document Title:

iFunBox Free 1.1 iOS – Local File Inclusion

Document Title:

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (2)

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)

#!/usr/bin/python

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)

# Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005

Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection (Metasploit)

##

Indeed Job Search 2.5 iOS API – Multiple Vulnerabilities

Document Title:

SEO Control Panel 3.6.0 – (Authenticated) SQL Injection

# Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection

Tenda A32 Router – Cross-Site Request Forgery

# Exploit Title: Tenda A32 Router CSRF Vulnerability(reboot the Router)

YourMembers Plugin – Blind SQL Injection

Vulnerability title: Blind SQL Injection Vulnerability in YourMembers plugin

Change CMS 3.6.8 – Multiple Cross-Site Request Forgery Vulnerabilities

# Exploit Title: RBS Change Complet Open Source multiple CSRF vulnerabilities POST and GET

Croogo 2.0.0 – Multiple Persistent Cross-Site Scripting Vulnerabilities

Croogo 2.0.0 – Arbitrary PHP Code Execution

#!/usr/bin/env python

PayPal Inc BB #85 MB iOS 4.6 – Authentication Bypass

Document Title:

Bosch Security Systems DVR 630/650/670 Series – Multiple Vulnerabilities

:::::::-. ... ::::::. :::.

CMS Made Simple 1.11.9 – Multiple Vulnerabilities

> Vulnerabilities in CMS Made Simple, version 1.11.9

GetSimple CMS 3.3.1 – Cross-Site Scripting

PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1

Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities

> Vulnerabilities in Pimcore 1.4.9 to 2.1.0 (inclusive)

vBulletin 4.x – breadcrumbs via xmlrpc API (Authenticated) SQL Injection

CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth)

vBulletin 4.x/5.x – AdminCP/ApiLog via xmlrpc API (Authenticated) Persistent Cross-Site Scripting

CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API (post-auth)

Nessus Web UI 2.3.3 – Persistent Cross-Site Scripting

Nessus Web UI 2.3.3: Stored XSS

DrayTek VigorACS SI 1.3.0 – Multiple Vulnerabilities

DrayTek VigorACS SI (

BMC Track-It! – Multiple Vulnerabilities

>> Multiple critical vulnerabilities in BMC Track-It!

WordPress Plugin Creative Contact Form 0.9.7 – Arbitrary File Upload

==========================================================

HttpCombiner ASP.NET – Remote File Disclosure

# Exploit Title: HttpCombiner ASP.NET Remote File Disclosure Vulnerability

Ultra Electronics 7.2.0.19/7.4.0.7 – Multiple Vulnerabilities

Ultra Electronics / AEP Networks - SSL VPN (Netilla / Series A / Ultra

Bash CGI – ‘Shellshock’ Remote Command Injection (Metasploit)

##

Moab < 7.2.9 - Authentication Bypass

##[Moab Authentication Bypass : CVE-2014-5300]##

Epicor Enterprise 7.4 – Multiple Vulnerabilities

"Epicor Enterprise vulnerabilities"

TestLink 1.9.11 – Multiple SQL Injections

Vulnerability title: Multiple SQL Injection Vulnerabilities in TestLink

PHPCompta/NOALYSS 6.7.1 5638 – Remote Command Execution

Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS

RBS Change Complet Open Source 3.6.8 – Cross-Site Request Forgery

# Exploit Title: RBS Change Complet Open Source CSRF

WordPress Plugin All In One WP Security & Firewall 3.8.3 – Persistent Cross-Site Scripting

Document Title:

Rejetto HTTP File Server (HFS) 2.3a/2.3b/2.3c – Remote Command Execution

==========================================================

Bacula-Web 5.2.10 – ‘joblogs.php?jobid’ SQL Injection

bacula-web 5.2.10 vulnerability

IPFire – CGI Web Interface (Authenticated) Bash Environment Variable Code Injection

#!/usr/bin/env python

OpenFiler 2.99.1 – Cross-Site Request Forgery

DoS

Microsoft Exchange – IIS HTTP Internal IP Address Disclosure (Metasploit)

# Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability

GS Foto Uebertraeger 3.0 iOS – Local File Inclusion

Document Title:

Typo3 Extension JobControl 2.14.0 – Cross-Site Scripting / SQL Injection

Mogwai Security Advisory MSA-2014-02

WordPress Plugin All In One WP Security 3.8.2 – SQL Injection

Advisory ID: HTB23231