PT-2014-5624

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.2.0 through 6.2.2 Description The issue concerns the Authentication component, which fails to properly invalidate timed out user sessions. This allows remote attackers to bypass authentication. Recommendations For TYPO3 versio...

AllMyLinks 0.5 (Auth Bypass) SQL Injection Vulnerability

Exploit for php platform in category web applications ----------exploit Debut Auth Bypass SQL Injection Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : http://www.voice-of-web.de/c-AllMyLinks-s37.html Version : 0.5.0 Download :...

AllMyGuests 0.4.1 (Auth Bypass) SQL Injection Vulnerability

Exploit for php platform in category web applications ----------exploit Debut Auth Bypass SQL Injection Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : http://www.voice-of-web.de/c-AllMyGuests-s38.html Version : 0.4.1 Download :...

AllMyVisitors 0.5.0 (Auth Bypass) SQL Injection Vulnerability

Exploit for php platform in category web applications ----------exploit Debut Auth Bypass SQL Injection Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : http://www.voice-of-web.de/c-AllMyVisitors-s29.html Version : 0.5.0 Download :...

oclHashcat v1.2 - GPGPU-based Multi-hash Cracker

oclHashcat is a GPGPU-based multi-hash cracker using a brute-force attack implemented as mask attack, combinator attack, dictionary attack, hybrid attack, mask attack, and rule-based attack. This GPU cracker is a fusioned version of oclHashcat-plus and oclHashcat-lite. GPU Driver requirements: NV...

[oss-security] CVE request: various NodeJS module vulnerabilities

Hi all, This is a request for CVEs for the following vulnerabilities discovered by the Node Security Project. I left out their advisories where I could find an assigned CVE; CVE-2013-7370 CVE-2013-7371 CVE-2013-6393 CVE-2013-4660 https://nodesecurity.io/advisories printer potential command...

PT-2014-2830

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2 Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for...

PT-2014-2620

Name of the Vulnerable Software and Affected Versions WordPress Simple Paypal Shopping Cart plugin versions prior to 3.6 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that change plugin settings. Recommendations...

PT-2014-2000

Name of the Vulnerable Software and Affected Versions Seagate BlackArmor NAS affected versions not specified Description The issue is related to insufficient input validation in the localJob.php and pre connect check.php scripts of the Seagate BlackArmor NAS web interface. This can be exploited b...

Command injection

Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service reachable assertion and crash via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice...

CVE-2014-1441: Concurrent Execution using Shared Resource with Improper Synchronization

Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service reachable assertion and crash via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice...

PT-2014-5113

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup version 7.3.0 Description The issue allows remote attackers to bypass authentication by setting the auth parameter to a certain string in the recoveryconsole/bpl/snmpd.php file. Recommendations For Unitrends...

Fedora 19 : zabbix-2.0.11-3.fc19 (2014-5551)

The logrotate configuration had no su statement in 2.0.11-2. Furthermore, the log file should have been created as zabbixsrv:zabbix for the proxy and server, what they are now. http://www.zabbix.com/rn2.0.11.php Also solves 3 security issues : - ZBX-7703 fixed being able to switch users without...

PT-2014-4183

Name of the Vulnerable Software and Affected Versions Core FTP Server version 1.2 before build 515 Description The issue allows remote attackers to cause a denial of service, resulting in a crash, via an AUTH SSL command with malformed data. This can be triggered by sending an AUTH SSL command wi...

python-keystoneclient: Potential context confusion in Keystone middleware

The authtoken middleware in the OpenStack Python client library for Keystone aka python-keystoneclient before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, relat...

CVE-2014-0188: Improper Authentication

The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request...

PT-2014-3479

Name of the Vulnerable Software and Affected Versions python-keystoneclient versions prior to 0.7.0 Description A context confusion issue exists in the Keystone auth token middleware, allowing remote authenticated users to potentially gain privileges under certain circumstances. This is related t...

python-keystoneclient: Potential context confusion in Keystone middleware

The authtoken middleware in the OpenStack Python client library for Keystone aka python-keystoneclient before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, relat...

SSL/TLS: FTP 'AUTH TLS' Command Detection

Checks if the remote FTP server supports SSL/TLS FTPS with the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2014-3511

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.2 WordPress versions 3.8.x prior to 3.8.2 Description The issue concerns the wp validate auth cookie function in wp-includes/pluggable.php, which does not properly determine the validity of authentication cookie...