CVE-2012-3394: Exposure of Sensitive Information to an Unauthorized Actor

auth/ldap/ntlmssoattempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2357: Exposure of Sensitive Information to an Unauthorized Actor

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

CVE-2012-2351

The vulnerability CVE-2012-2351 affects Mahara’s auth/saml plugin. In Mahara versions older than 1.4.2, the default setting for “Match username attribute to Remote username” is false, enabling a remote SAML IdP to spoof users on other IdPs by reusing the same internal username. This is a configur...

CVE-2012-2351: Improper Access Control

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

PT-2012-3972

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.4.2 Description The default configuration of the auth/saml plugin in Mahara allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username, due to the "Match username...

Auth bypass in index.php - ownCloud

index.php before ownCloud 4.0.7 does not properly validate the octoken cookie, which allows remote attackers to bypass authentication via a crafted octoken cookie value. Affected Software ownCloud Server 4.0.7 CVE-2012-4392 Action Taken It is recommended that all instances are upgraded to ownClou...

[SECURITY] Fedora 16 Update: lighttpd-1.4.31-1.fc16

Secure, fast, compliant and very flexible web-server which has been optimiz ed for high-performance environments. It has a very low memory footprint compa red to other webservers and takes care of cpu-load. Its advanced feature-set FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many mo...

Community Classifieds v2.1 Auth Bypass/XSS Vulnerabilties

Exploit for php platform in category web applications Community Classifieds v2.1 Auth Bypass/XSS Vulnerabilties ======================================================================= .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://www.idealwebcreators.com/ === Exploit === Auth...

PHP Online Chat v1.0 Multiple Vulnerabilties

Exploit for php platform in category web applications PHP Online Chat v1.0 Multiple Vulnerabilties ======================================================================= .:. Author : AtT4CKxT3rR0r1ST email protected .:. Script : http://phponlinechat.com/ .:. Tested On Demo :...

Annexwaretexolution SQL Injection

============================================================= Microworkers clone script by: Annexwaretexolution http://www.annexware.com/ Official site seems down for now alternatively you can find this script in eg from here: http://clonesite.do.am/load/0-0-1-163-20 or from google...

Simple Document Management System 1.1.5 / 2.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Simple Document Management System 1.1.5 / 2.0 Multiple Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS twitter: @JossGongora contact: sys-projectathotmaildotcom website: http://www.hack0wn.com/ download:...

Simple Document Management System 1.1.5 / 2.0 SQL Injection

Simple Document Management System 1.1.5 / 2.0 Multiple Vulnerabilities bug found by Jose Luis Gongora Fernandez a.k.a JosS twitter: @JossGongora contact: sys-projectathotmaildotcom website: http://www.hack0wn.com/ download: http://mirror.us.cc.com.au/pub/cafuego/sdms ----------- version 2.0...

Edimax IC-3030iWn - UDP Packet Password Information Disclosure

Edimax IC-3030iWn - UDP Packet Password Information Disclosure source: https://www.securityfocus.com/bid/54006/info Edimax IC-3030iWn is prone to an information-disclosure vulnerability. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained...

Edimax IC-3030iWn Web Admin Auth Bypass exploit

Exploit for hardware platform in category web applications This exploit against: - Edimax IC-3030i - Edimax IC-3015 - Airlive WN 500 !/usr/bin/env python """ Exploit Title: Edimax IC-3030iWn Web Admin Auth Bypass exploit Date: 4 April 2012 Exploit Author: email protected, @y3dips URL:...

phpAcounts v. 0. 5. 3 SQL injection and fix-vulnerability warning-the black bar safety net

Author: loneferret Affected version: 0.5.3 Developer address: http://phpaccounts.com/ Test platform: Ubuntu Server 11.10 Old app, still fun. Auth. Bypass: http://www.xxx.com /phpaccounts/index.php Username: x' or '1'='1' Password: whatever Upload php shell in preferences Letterhead image upload...

phpAccounts 0.5.3 SQL Injection

Exploit phpAcounts v.0.5.3 SQL Injection Date: June 6nd 2012 Author: loneferret Version: 0.5.3 Vendor Url: http://phpaccounts.com/ Tested on: Ubuntu Server 11.10 Discovered by: loneferret Old app, still fun. Auth. Bypass: http:///phpaccounts/index.php Username: x' or '1'='1' Password: Upload php...

phpAcounts 0.5.3 - SQL Injection

phpAcounts 0.5.3 - SQL Injection Exploit phpAcounts v.0.5.3 SQL Injection Date: June 6nd 2012 Author: loneferret Version: 0.5.3 Vendor Url: http://phpaccounts.com/ Tested on: Ubuntu Server 11.10 Discovered by: loneferret Old app, still fun. Auth. Bypass: http:///phpaccounts/index.php Username: x'...