Search | Research | Contact Us Monday September 12, 2021
Languages
Most Viewed Items
  1 PHPXMLRPC Library Remote Code Execution
  2 Multiple Invision Power Board Vulnerabilities
  3 eBay And Amazon Still Vulnerable
  4 When Small Mistakes Can Cause Big Problems
  5 Woltlab Burning Board SQL Injection Vulnerability
  6 Multiple Vulnerabilities In phpWebsite
  7 XOOPS 2.0.11 && Earlier Multiple Vulnerabilities
  8 Critical Vulnerability In Help Center Live
  9 dbPowerAmp Buffer Overflow And DoS Vulnerabilities
10 Document Object Model Hijacking Explained
Need Secure Code?
Quick Search
You can use the form below to search our site. Just enter the keywords to search.
Home Services Archives Research Downloads Contact
Security Issues In CGINews And CGIForum December 14, 2021
CGINews and CGIForum are two fairly popular scripts by Markus Triska. CGINews is a multi-user Web site news posting system written in Perl. And CGIForum is A template based discussion board also written in Perl. However they both rely on a very weak encryption algorithm that can be decrypted easily. The author has no plans on switching to a more secure one way encryption, so if security is a concern try another forum system.
Read This Article Article Read 235 Times
osCommerce 2.2-MS1 SQL Injection Vulnerability December 12, 2021
osCommerce is one of the most popular Open Source e-commerce solutions in the world today. It comes with many out of the box features and is constantly being developed by the Open Source Community. Recently GulfTech Security Research has discovered an SQL Injection vuln in the create_account_process.php and the account_edit_process.php files. This vulnerability is present in osCommerce 2.2-MS1 but does not appear to be an issue in osCommerce 2.2-MS2. Advice to all osCommerce shop owners is to upgrade to the latest version of osCommerce by clicking here.
Read This Article Article Read 422 Times
Multiple Vulnerabilities In Snitz Forums 2000 June 16, 2022
Snitz forums is a full-featured UBB-style ASP discussion board application used by thousands of people across the web. Recently I found many serious vulnerabilities in this application that may allow an attacker to take over an entire Snitz forum. The vulnerabilities include cross site scripting issues, cookie authentication bypass vulnerability, and a password reset vulnerability. Users are encouraged to upgrade as soon as possible.
Read This Article Article Read 582 Times
Multiple Vulnerabilities In Max Web Portal June 06, 2022
MaxWebPortal is a web portal and online community system which includes advanced features such as web-based administration, poll, private/public events calendar, user customizable color themes, classifieds, user control panel, online pager, link, file, article, picture managers and much more. Easy-to-use and powerful user interface allows members to add news, content, write reviews and share information among other registered users. MaxWebPortal has multiple vulnerabilities which include cross site scripting, hidden form weaknesses, Database exposure, and a password reset vulnerability.
Read This Article Article Read 374 Times
QPC MegaBrowser Multiple Vulnerabilities June 04, 2022
QPC MegaBrowser is a webserver / FTP server in one. Aimed at home users and small business who would like to run their own FTP and HTTP servers. However it is vulnerable to a directory traversal vulnerability which allows access to any file on the system as well as directory viewing of the root web directory. There is also a user enumeration vulnerability in the FTP server that allows an attacker to enumerate valid usernames.
Read This Article Article Read 223 Times
Vulns In Pablo Software Solutions FTP Service 1.2 June 03, 2022
FTPService.exe is a service-version of Pablo's FTP Server. This service enables you to have the Pablo FTP server active even when you're not logged into Windows. By default this application is totally open to compromise, and also leaves the users machine open to attacks by allowing access to any file in the C drive. This can be prevented by changing privileges of, or disabling access to the anonymous account. The passwords for Pablo FTP Service are also stored in plaintext, which can definitely be a big threat if the default anonymous account is enabled.
Read This Article Article Read 275 Times
WinMX Plaintext Password Vulnerabilities June 02, 2022
WinMX 2.6 is an older version of the popular file sharing client WinMX. While the current version is 3.31, 2.6 still remains quite popular. Especially amongst users on private networks. I believe this is largely due to the fact that 2.6 does not have the option to output .wsx file (WinMX server list files) This helps keep the addresses for private OpenNap servers out of the hands of uninvited users (amongst other reasons). The problems with WinMX 2.6 is that it provides pretty much NO password protection. This can be exploited both locally and remotely. Again, I think all of us have seen the bad habit that most people have of using the same password for multiple accounts etc etc.
Read This Article Article Read 604 Times
Vulnerabilities In P-Synch Password Management May 30, 2022
P-Synch is a total password management solution. It is intended to reduce the cost of ownership of password systems, and simultaneously improve the security of password protected systems. This is done through: Password Synchronization. Enforcing an enterprise wide password strength policy. Allowing authenticated users to reset their own forgotten passwords and enable their locked out accounts. Streamlining help desk call resolution for password resets. P-Synch is available for both internal use, on the corporate Intranet, as well as for the Internet deployment in B2B and B2C applications. There are a few vulnerabilities in P-Synch such as path disclosure, cross site scripting, and arbitrary file inclusion. Users should upgrade immediately.
Read This Article Article Read 268 Times
SubScan 1.2 DNS Discovery Utility Released May 25, 2022
SubScan is a DNS utility that i built for myself and decided to share it with the public. Any of you who have used the earlier versions should know that this version is COMPLETELY different. It's almost a completely different program, but accomplishes the same thing really. Here are some things that are new and improved in SubScan 1.2 If you have any comments, questions, or need help or anything else feel free to ask on the forums. Be sure to check out the readme file first though, as it might just have the answer you are looking for. Anyone using the contact forms for tech questions will be ignored.
Read This Article Article Read 85 Times
IISamDiscover And IISamCrack Now Available May 02, 2022
Recently I noticed that the Microsoft IIS Accounts Manager could be used to verify accounts much like the VRFY and EXPN commands with sendmail. Turns out that David Lichtfield discovered this vuln years earlier, but I don't think it was ever an official BID until I posted the issue to BugTraq. Anyway, below is a link to the example code that I wrote. The versions posted at BugTraq are the same, but the formatting got completely trashed. IISamCrack attempts to enumerate weak passwords using a dictionary style attck on the Microsoft IIS Accounts Manager. IISamDiscover uses the Accounts Manager User Existence Disclosure Vulnerability to confirm or deny the exsistance of a user on the machine using a list of probable usernames.
Read This Article Article Read 87 Times
Results 81 - 10 of 10 Results per-page: 5 | 10 | 20 | 50