Text Exploits
31,337 exploits tracked across all sources.
Opera Browser < 12.11 - Memory Corruption
Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a malformed image.
by coolkaveh
Symantec Messaging Gateway <10.0 - CSRF
Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators.
by Ben Williams
Symantec Messaging Gateway - Path Traversal
Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.
by Ben Williams
Oracle MySQL <5.5.38 & MariaDB <5.5.28a - Info Disclosure
Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.
by kingcope
MySQL - 'Stuxnet Technique' Windows Remote System
by kingcope
IBM Director < 5.20.3 - Path Traversal
Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
by kingcope
Freesshd < 1.2.6 - Authentication Bypass
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
by kingcope
Freesshd < 1.2.6 - Authentication Bypass
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
by kingcope
SSH Tectia Server - Authentication Bypass
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.
by kingcope
Oracle MySQL <5.1.67 & <5.5.29 - DoS
Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique, nested elements.
by kingcope
Fortinet FortiWeb (Multiple Appliances) - Multiple Cross-Site Scripting Vulnerabilities
by Benjamin Kunz Mejri
SmartCMS - '/index.php?menuitem' SQL Injection / Cross-Site Scripting
by Yakir Wizman
SilverStripe CMS 3.0.2 - (Multiple Vulnerabilities) Cross-Site Scripting / Cross-Site Request Forgery
by Sense of Security
Free Hosting Manager 2.0 - 'id' SQL Injection
by Yakir Wizman
WordPress Theme Toolbox - 'mls' SQL Injection
by Ashiyane Digital Security Team
Video-lead-form Uk-cookie - XSS
Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.
by Aditya Balapure
Oracle OpenSSO 8.0 - Multiple Cross-Site Scripting POST Injection Vulnerabilities
by LiquidWorm
FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass
by Soroush Dalili
gleamtech filevista/fileultimate 4.6 - Directory Traversal
by Soroush Dalili
BigDump 0.29b and 0.32b - Multiple Vulnerabilities
by Ur0b0r0x
WordPress Theme CStar Design - 'id' SQL Injection
by Amirh03in
By Source