Exploitdb Exploits
31,357 exploits tracked across all sources.
Xen 3.0.3, 3.3.0, 3.3.1 - Unauthenticated Boot Parameter Modification via pyGrub
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
by Jan Lieskovsky
Cisco ACE Web Application Firewall and ACE XML Gateway < 6.1 - Information Disclosure via Unhandled HTTP Request
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
by nitr0us
Activedition - '/activedition/aelogin.asp' Multiple Cross-Site Scripting Vulnerabilities
by Richard Brain
Fastball (com_fastball) 1.1.0-1.2 - SQL Injection via League Parameter
SQL injection vulnerability in the Fastball (com_fastball) component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the league parameter to index.php.
by kaMtiEz
e107 < 0.7.16 - Cross-Site Scripting via HTTP Referer Header
Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action.
by MustLive
Avast! AntiVirus 4.8.1351.0 - Denial of Service / Privilege Escalation
by Evilcry
Vastal I-Tech Agent Zone - 'view_listing.php' SQL Injection
by OoN_Boy
OSSIM < 2.1.2 - Cross-Site Scripting via Option Parameter
Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).
by Alexey Sintsov
Novell Edirectory 8.8 SP5 - Cross-Site Scripting
by Francis Provencher
nginx <0.7.63, <0.8.17 - Path Traversal
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
by kingcope
IBM Lotus Connections 2.0.1 - Cross-Site Scripting via Simple Search Name Parameter
Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
by IBM
Vastal I-Tech DVD Zone - SQL Injection via view_mag.php mag_id Parameter
SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.
by OoN_Boy
Vastal I-Tech DVD Zone - Cross-Site Scripting via view_mag.php mag_id Parameter
Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.
by OoN_Boy
Vastal I-Tech Cosmetics Zone - 'view_products.php' SQL Injection
by OoN_Boy
Kinfusion SportFusion 0.2.2-0.2.3 - SQL Injection via cid[0] Parameter
SQL injection vulnerability in the Kinfusion SportFusion (com_sportfusion) component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
by kaMtiEz
JoomlaFacebook (com_facebook) - SQL Injection via id Parameter
SQL injection vulnerability in the JoomlaFacebook (com_facebook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
by kaMtiEz
Joomla! Component GroupJive 1.8 B4 - Remote File Inclusion
by M3NW5
JoomlaFacebook (com_facebook) - SQL Injection via id Parameter
SQL injection vulnerability in the JoomlaFacebook (com_facebook) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a student action to index.php.
by kaMtiEz
com_tupinambis 1.0 - SQL Injection via Proyecto Parameter
SQL injection vulnerability in the Tupinambis (com_tupinambis) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the proyecto parameter in a verproyecto action to index.php.
by Don Tukulesto
By Source