webapps

Imagam iFiles 1.16.0 iOS – Multiple Web Vulnerabilities

Document Title:

Dokeos 2.2 RC2 – ‘index.php?language’ SQL Injection

Advisory ID: HTB23181

Chamilo Lms 1.9.6 – ‘profile.php?password’ SQL Injection

Advisory ID: HTB23182

WordPress Plugin Formcraft – SQL Injection

#######################################################################

Photo Transfer Wifi 1.4.4 iOS – Multiple Web Vulnerabilities

Document Title:

D-Link DIR-Series Routers – ‘/model/__show_info.php’ Local File Disclosure

source: https://www.securityfocus.com/bid/64043/info

PHPThumb – ‘PHPThumb.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/64041/info

TVT TD-2308SS-B DVR – Directory Traversal

# Exploit Title: TVT TD-2308SS-B DVR directory traversal

Multiple WordPress Orange Themes – Cross-Site Request Forgery (Arbitrary File Upload)

#Title : Wordpress Orange Themes CSRF File Upload Vulnerability

MyBB 1.6.11 – Remote Code Execution

Scientific-Atlanta, Inc. DPR2320R2 – Multiple Cross-Site Request Forgery Vulnerabilities

###########################################################

TP-Link TD-8840t – Cross-Site Request Forgery

######################################################################

Zend-Framework – Full Information Disclosure

# Exploit Title : Zend-Framework Full Info Disclosure

Ametys CMS 3.5.2 – ‘lang’ XPath Injection

Ametys CMS 3.5.2 (lang parameter) XPath Injection Vulnerability

FlashComs Chat 6.5 – Arbitrary File Upload

Palo Alto Networks Pan-OS 5.0.8 – Multiple Vulnerabilities

from http://thomaspollet.blogspot.be/2013/11/Palo-Alto-XSS.html

WordPress Plugin dzs-videogallery – Arbitrary File Upload

###################################################################################################

TP-Link WR740N/WR740ND – Multiple Cross-Site Request Forgery Vulnerabilities

# Exploit Title: TPLINK WR740N Multiple CSRF Vulnerabilities

MyBB Ajaxfs 2 Plugin – SQL Injection

###########################

Pirelli Discus DRG A125g – Remote Change WiFi Password

# Exploit Title: Pirelli Discus DRG A125g remote change wifi password

Pirelli Discus DRG A125g – Local Password Disclosure

#!/usr/bin/perl

Pirelli Discus DRG A125g – Remote Change SSID Value

# Exploit Title: Pirelli Discus DRG A125g remote change SSID value

ImpressPages CMS 3.8 – Persistent Cross-Site Scripting

###########################################################

LimeSurvey 2.00+ (build 131107) – Multiple Vulnerabilities

LimeSurvey v2.00+ (build 131107) Script Insertion And SQL Injection Vulnerability

WordPress Plugin Blue Wrench Video Widget – Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/63800/info

WordPress Theme Suco – ‘themify-ajax.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/63836/info

PHP-Nuke 8.2.4 – Multiple Vulnerabilities

[SOJOBO-ADV-13-04] - PHP-Nuke 8.2.4 multiple vulnerabilities

Ruckus Wireless Zoneflex 2942 Wireless Access Point – Authentication Bypass

Exploit Title: Ruckus Wireless Zoneflex 2942 Wireless Access Point vulnerable to authentication bypass

Kaseya < 6.3.0.2 - Arbitrary File Upload

( , ) (,

ManageEngine Desktop Central 8.0.0 build < 80293 - Arbitrary File Upload

( , ) (,

LiveZilla 5.0.1.4 – Remote Code Execution

CVE-2013-6225: Security Advisory – Curesec Research Team

Dahua DVR 2.608.0000.0/2.608.GV00.0 – Authentication Bypass (Metasploit)

Dahua DVR Authentication Bypass - CVE-2013-6117

WordPress Theme Make A Statement (MaS) – Cross-Site Request Forgery

#Title : Wordpress Make A Statement Themes CSRF File Upload Vulnerability

WordPress Theme Amplus – Cross-Site Request Forgery

#Title : Wordpress Amplus Themes CSRF File Upload Vulnerability

WordPress Theme Dimension – Cross-Site Request Forgery

#Title : Wordpress Dimension Themes CSRF File Upload Vulnerability

WordPress Theme Euclid 1.x – Cross-Site Request Forgery

#Title : Wordpress Euclid V1 Themes CSRF File Upload Vulnerability

TomatoCart 1.1.8.2 – ‘class’ Local File Inclusion

source: https://www.securityfocus.com/bid/63795/info

Limonade Framework – ‘limonade.php’ Local File Disclosure

source: https://www.securityfocus.com/bid/63771/info

Google Gmail IOS Mobile Application – Persistent Cross-Site Scripting

Title:

WBR-3406 Wireless Broadband NAT Router – Web-Console Password Change Bypass / Cross-Site Request Forgery

# -----------------------------------------------------------

TOSHIBA e-Studio 232/233/282/283 – Cross-Site Request Forgery (Change Admin Password)

# Exploit Title: TOSHIBA e-Studio 232/233/282/283 Change Admin Password CSRF Vulnerability

Testa OTMS – Multiple SQL Injections

source: https://www.securityfocus.com/bid/63773/info

Juniper Junos J-Web – Privilege Escalation

Sense of Security - Security Advisory - SOS-13-003 security advisory

WordPress Theme Highlight Premium – Cross-Site Request Forgery / Arbitrary File Upload

#Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability

Horde Groupware Web Mail Edition 5.1.2 – Cross-Site Request Forgery (2)

#############################

Sagemcom F@st 3184 2.1.11 – Multiple Vulnerabilities

+------------------------------------------------------------------------------+

Project’Or RIA 3.4.0 – ‘objectDetail.php?objectId’ SQL Injection

=============================================

Vivotek IP Cameras – RTSP Authentication Bypass

Core Security - Corelabs Advisory

appRain 3.0.2 – Blind SQL Injection

Advisory ID: HTB23177

Flatpress 1.0 – Remote Code Execution

#!/usr/bin/perl