NukeCalendar 1.1 .a block-Calendar_center.php Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/10082/info NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities. These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences inclu...

NukeCalendar 1.1 .a block-Calendar1.php Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/10082/info NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities. These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences inclu...

HackerOne: Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)

Hi, Hope you are good! Steps to repro: 1 Create a HackerOne account having email address "[email protected]". 2 Now Logout and ask for password reset link. Don't use the password reset link. 3 Login using the same password back and update your email address to "[email protected]" and verify the same. 4 Now logout an...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

Exploit for php platform in category web applications 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

SimpleRisk 20130915-01 - Multiple Vulnerabilities 1. Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS...

SimpleRisk 20130915-01 Cross Site Request Forgery / Cross Site Scripting

Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-A3 Impact: Full Account Compromise...

SimpleRisk 20130915-01 - Multiple Vulnerabilities

Advisory Information Title: SimpleRisk v.20130915-01 CSRF-XSS Account Compromise Advisory ID: RS-2013-0001 Date Published: 2013-09-30 2. Vulnerability Information Type: Cross-Site Request Forgery CSRF CWE-352, OWASP-A8, Cross-Site Scripting XSS CWE-79, OWASP-A3 Impact: Full Account Compromise...

Paypal Bug Bounty #102 QRL - Auth Bypass Vulnerability

Document Title: =============== Paypal Bug Bounty 102 QRL - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=995 PayPal Security UID: ZVf25kC Release Date: ============= 2013-07-04 Vulnerability Laboratory ID VL-ID:...

Sony PSN Account Service - Password Reset Vulnerability

Document Title: =============== Sony PSN Account Service - Password Reset Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=740 Release Date: ============= 2013-05-11 Vulnerability Laboratory ID VL-ID: ==================================== 740...

discuz找回密码逻辑小缺陷

简要描述： 如果当前密码被他人知道 可能导致永远无法找回密码 详细说明： 某日，社工某骗子的某论坛ID发现的 通过过去csdn数据库查到了他的密码，竟然是一样的，果断登陆 登陆之后，想想，给他密码和邮箱修改了，改到了自己的 突然想研究下找回密码，只对次数进行了过滤，最后一次有效…… 试了下……更改邮箱之后之前邮箱里发的找回密码的邮件竟然还有效…… 首先各种办法，得到某ID，更改邮箱和密码，通过找回密码往自己改后的邮箱发找回密码的邮件，然后……ID主人发现被盗，邮箱被改肯定会联系管理员啊，管理员帮他改好了，你再用你改后邮箱里邮件找回密码，如此重复，一个ID就彻底废了 漏洞证明： 密码被他人...

ViewGit 0.0.6 - Multiple XSS Vulnerabilities

ViewGit "is a git web repository viewer that aims to be easy to set up and upgrade, light on dependencies, and comfortable to use." http://viewgit.fealdia.org/. ViewGit contains multiple persistent arbitrary script injection XSS vulnerabilities in its "Shortlog" and "Heads" tables. These...

Facebook Camera App Vulnerable to Man in The Middle Attack

Egypt-based security researcher reported that Facebook Camera App for mobiles are Vulnerable to Man in The Middle Attack, that allow an attacker to tap the network and hijack Camera users accounts and information like email addresses and passwords can be stolen. Mohamed Ramadan trainer with...

Novell NetIQ Privileged User Manager modifyAccounts Security Bypass

Added: 12/07/2012 BID: 56535 OSVDB: 87335 Background Novell NetIQ Privileged User Manager NPUM allows IT administrators to work on systems without exposing superuser administrator or supervisor passwords or root-account credentials to the administrator. Problem NetIQ Privileged User Manager 2.3.1...

15000 Wordpress blogs hacked for making money from Survey

Wordpress Security Team is sending out warning messages to thousands of wordpress users that their account has been compromised recently. Warning message include "We recently detected suspicious activity on your WordPress.com account. To protect your identity and keep your site safe, we've reset...

Password Leaks Continue: Billabong, NVIDIA Accounts Compromised

UPDATE: A string of high-profile hacks against online forums and companies continued on Thursday, with news that forums hosted by the technology firm NVIDIA as well as the surf-ware vendor Billabong. A document posted on the Web site codepaste.net purports to contain both administrative- and user...

Android Forums hacked, User Credentials Stolen

Phandroid's Android Forums Web site is hacked and user account details stolen, according to a notice posted online. The data includes the user names, e-mail addresses, hashed passwords, and registration IP addresses of the forums' more than 1 million users. If you are one of them, you should chan...

Freeside SelfService CGI|API 2.3.3 - Multiple Vulnerabilities

Title: ====== Freeside SelfService CGI|API 2.3.3 - Multiple Vulnerabilities Date: ===== 2012-06-14 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=614 VL-ID: ===== 614 Common Vulnerability Scoring System: ==================================== 6.5 Introduction:...

GuestBook Scripts PHP v1.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title: ====== GuestBook Scripts PHP v1.5 - Multiple Web Vulnerabilites Common Vulnerability Scoring System: ==================================== 7.5 Introduction: ============= GuestBook Script PHP is a script that is very easy to install,...

Every day buy UC_KEY not initialize the security risks and patch-vulnerability warning-the black bar safety net

Every day buy integrated ucenter one-stop login api,but UCkey not initialized will cause the attacker can log in to any account,or even operate the credit card information. Detailed description: $get = $post = array; $code = @$GET'code'; //get the token parsestrauthcode$code, 'DECODE', UCKEY, $ge...

Mathematica On Linux /tmp Vulnerability

"If you're doing anything technical, think Mathematica --..." http://www.wolfram.com/products/mathematica/index.html Mathematica7 on Linux uses the /tmp/MathLink directory in insecure ways. Mathematica creates or re-uses an existing /tmp/MathLink directory, and overwrites files within and follows...