PT-2015-7481

Name of the Vulnerable Software and Affected Versions Commerce Commonwealth CBA module versions 7.x-1.x through 7.x-1.4 Description The issue is related to improper validation of payments, allowing remote attackers to make a failed payment appear valid by using a crafted URL. This is related to a...

CVE-2015-7231: Improper Input Validation

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...

pgbouncer -- failed auth_query lookup leads to connection as auth_user

PgBouncer reports: New authuser functionality introduced in 1.6 allows login as authuser when client presents unknown username. It's quite likely authuser is superuser. Affects only setups that have enabled authuser in their config...

WordPress Plugin WP Mobile Edition - Local File Inclusion

Exploit Title: Wordpress Plugin 'WP Mobile Edition' LFI Vulnerability Date: june 6, 2015 Exploit Author: ViRuS OS Google Dork: inurl:?fdxswitcher=mobile Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/ Software Link:...

Discuz Forum auto-blasting tools principles of analysis-vulnerability warning-the black bar safety net

Recently broke about the use of social work library blasting Discuz Forum user name and password of the tool, causing a lot of Forum user information leakage, the analysis works as follows. Here Discuz determines whether the access IP of main with the following logic: private function getclientip...

HackerOne: Making any Report Failed to load

Hello, I found a way to make any report failed to load using this code with Hex Character: www.%40ebаy.com I was testing for Homographic Issue using Hex Characters and I listed all of hex character and tried to bypass. Then, when I paste the list and comment it in a report I experienced report...

Code injection

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

CVE-2014-6092: Undefined Security Weakness

IBM Curam Social Program Management SPM 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to caus...

PT-2015-3811

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management SPM versions 5.2 through 5.2 before SP6 EP6 IBM Curam Social Program Management SPM versions 6.0 SP2 through 6.0 SP2 before EP26 IBM Curam Social Program Management SPM versions 6.0.4 through 6.0.4 before...

Moodle 2.7.x < 2.7.1 XSS

Binary data 8717.prm...

Shopify: Authentication Failed Mobile version

1 access shopify.com login 2 access your profile change password Insert a new password and select the 'Also log out of your store on Shopify Mobile and / or Shopify POS' field. In my test session was not closed in mobile version for Android. Please check it...

CVE-2015-1227

Removed by vendor...

CVE-2015-1227: Undefined Security Weakness

The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which t...

Apple iOS 8.x < 8.1.1 Multiple Vulnerabilities.

Binary data 8940.prm...

PT-2015-5182

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 41.0.2272.76 Opera affected versions not specified Description The issue is related to the DragImage::create function in Blink, which does not initialize memory for image drawing. This allows remote attackers to...

SSH Login Failed For Authenticated Checks

It was NOT possible to login using the provided SSH credentials. Hence authenticated checks are NOT enabled. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

failedloginattempts v1.0.1

plgfailedloginattemptsv1.0.1j25j30, 1.0.1, Information Disclosure Developers update statements 12-Dec-2014 : v1.1.0 http://www.web357.eu/news/releases/68-failed-login-attempts-v1-1-0-has-been-released-security-release.html...

CVE-2014-4451: Undefined Security Weakness

Apple iOS before 8.1.1 does not properly enforce the failed-passcode limit, which makes it easier for physically proximate attackers to bypass the lock-screen protection mechanism via a series of guesses...

PT-2014-5913

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.1 Description The issue concerns the lock-screen protection mechanism, where the failed-passcode limit is not properly enforced. This makes it easier for physically proximate attackers to bypass the lock screen...

Microsoft Windows Remote Desktop Protocol Security Feature Bypass Vulnerability (3003743)

This host is missing an important security update according to Microsoft Bulletin MS14-074. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...