PT-2012-6369

Web-интерфейс межсетевого экрана/маршрутизатора Zyxel ZyWALL USG 300 содержит уязвимость, связанную с выполнением авторизации на стороне клиента. Это позволяет злоумышленнику получить права администратора устройства путем манипулирования параметром «IsAdmin»...

TOSHIBA TEC e-Studio series vulnerable to authentication bypass

Overview Multiple e-Studio series products provided by TOSHIBA TEC CORPORATION contain an authentication bypass vulnerability. e-Studio is a multi-function peripheral MFP. Multiple e-Studio series products contain a vulnerability in web-based management utility, which may result in an...

LandShop CMS v0.9.2 - Multiple Web Vulnerabilities

Document Title: =============== LandShop CMS v0.9.2 - Multiple Web Vulnerabilities References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=485 Release Date: ============= 2012-03-31 Vulnerability Laboratory ID VL-ID: ==================================== 485 Product ...

Toenda CMS 1.6.2 Osaka Stable Local File Inclusion

Exploit for php platform in category web applications ============TOENDA CMS 1.6.2 OSAKA "STABLE" MULTIPLE VULNERABILITIES============ Vulnerable Software: toendaCMS1.6.2OsakaStable Developed by: http://www.toendacms.org/index.php/en/open/download.html toenda.com...

Xoops 2.5.4 Blind SQL Injection

Exploit for php platform in category web applications ------------------------------------------ Xoops 2.5.4 Blind SQL Injection ------------------------------------------ Dork: "Powered by XOOPS 2.5.4" Download: http://sourceforge.net/projects/xoops/ Date: 10/12/2011 Author: blkhtc0rp Mail:...

CVE-2011-1372

The CVE-2011-1372 issue affects IBM TS3100/TS3200 Tape Libraries with firmware versions older than A.60. The Web User Interface could be exploited remotely to bypass authentication and grant administrative access without valid credentials. IBM’s security bulletin and Trustwave advisory confirm an...

Postgres Password Hashdump

This module extracts the usernames and encrypted password hashes from a Postgres server and stores them for later cracking. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postgres Password...

A-Form vulnerable in restricting access

Overview A-Form contains a vulnerability in restricting access permissions. A-Form is a plug-in for Movable Type that adds mail forms and survey forms. A-Form contains a vulnerability in restricting access permissions. Impact Information managed by A-Form may be altered by a user who does not hav...

EFront 3.6.9 Community Edition multiple vulnerabilities-vulnerability warning-the black bar safety net

Exploit Title: EFront = 3.6.9 Community Edition Multiple Vulnerabilities Google Dork: "eFront version 3.6.9" inurl:index. php? ctg= Date: 5/09/2011 Public release: When 3.6.10 will be released Author: IHTeam Software Link:http://www.efrontlearning.net/download/download-efront.html Tested on:...

EFront 3.6.9 Community Edition - Multiple Vulnerabilities

EFront 3.6.9 Community Edition - Multiple Vulnerabilities Exploit Title: EFront UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/professor.php?ctg=messages&folder= UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/admin.php?ctg=messages&folder= UNION...

EFront <= 3.6.9 Community Edition Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: EFront UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/professor.php?ctg=messages&folder= UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users -- www/admin.php?ctg=messages&folder= UNION ALL...

BaserCMS vulnerable to access restriction

Overview BaserCMS contains a vulnerability in access restriction. BaserCMS is an open-source Contents Management System CMS. BaserCMS contains a vulnerability in access restriction where adding a user in the user group "operators" which is created by default when BaserCMS is installed. Masako Ohn...

CVE-2011-3008

The default configuration of Avaya Secure Access Link SAL Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these...

Dreamzsop SQL Injection Vulnerbility

Exploit for php platform in category web applications Exploit Title: SQL Injection Vulnerbility in Dreamzsop Google Dork: intext:"By: Dreamzsop" Date: 30/5/2011 Author: lionaneesh Software Link: http://dreamzsop.co.in/ Risk Level : High A hacker can get admin access to web database leading to...

PHPortfolio SQL Injection

Exploit Title: SQL Injection Vulnerbility in PHP Portfolio Google Dork: "Powered by PHPortfolio" Date: 23/5/2011 Author: lionaneesh Software Link: http://outshine.com/phportfolio/ http://www.outshine.com/software/phportfolio/intro.php Risk Level : High A hacker can get admin access to web databas...

PHPortfolio SQL Injection Vulnerbility

Exploit for php platform in category web applications Exploit Title: SQL Injection Vulnerbility in PHP Portfolio Google Dork: "Powered by PHPortfolio" Date: 23/5/2011 Author: lionaneesh Software Link: http://outshine.com/phportfolio/ http://www.outshine.com/software/phportfolio/intro.php Risk Lev...

PHPortfolio - SQL Injection

Exploit Title: SQL Injection Vulnerbility in PHP Portfolio Google Dork: "Powered by PHPortfolio" Date: 23/5/2011 Author: lionaneesh Software Link: http://outshine.com/phportfolio/ http://www.outshine.com/software/phportfolio/intro.php Risk Level : High A hacker can get admin access to web databas...

SA-CONTRIB-2011-020 - Taxonomy Access Control Lite (tac_lite) - Cross Site Scripting

The taclite module allows site administrators to hide nodes and taxonomy terms from users without permission to view them. The permission to view terms can be granted to a specific user, or all users with a specific role. The module doesn't sufficiently strip markup when rendering taxonomy names,...

Albanian Ministry of Justice Exploited by ATH-Cr3w

Albanian Ministry of Justice Exploited by ATH-Cr3w ATH-Cr3w Hack into Albanian Ministry of Justice's Website and Extract Database + Do Admin access. They Upload data here :...

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...