CVE-2010-1648

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

CVE-2010-1648: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that 1 create accounts or 2 reset passwords, related to the Special:Userlogin form...

mediawiki -- two security vulnerabilities

Two security vulnerabilities were discovered: Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer. A CSRF vulnerability was discovered ...

SA-CONTRIB-2010-045 - Auto Assign Role - Access bypass

The Auto Assign Role serves three primary purposes. The first is to provide an automatic assignment of roles when a new account is created. The second is to allow the end user the option of choosing their own role or roles when they create their account. The third is to provide paths that will...

CVE-2010-1616

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability...

CVE-2009-4787: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...

As soon as you log in

Once your account in created, immediately click on “Settings” and you get this page. Note my email address is one I created for use in registering online “play” accounts. I have separated it from my normal email account. If I lose any of my online accounts, there won’t be any banking information ...

Maian Greetings 2.1 - Arbitrary File Upload

======================================================================================== | email : [email protected] | Home : www.iq-ty.com/vb - Souk Naamane - 04325 - Oum El Bouaghi - Algeria -00213771818860 | Web Site :...

Multiple Vulnerabilities in Cisco Unified MeetingPlace

No description provided by source. Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Advisory ID: cisco-sa-20100127-mp Revision 1.0 For Public Release 2010 Jan 27 1600 UTC GMT +--------------------------------------------------------------------- Summary =======...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Advisory ID: cisco-sa-20100127-mp Revision 1.0 For Public Release 2010 Jan 27 1600 UTC GMT +--------------------------------------------------------------------- Summary...

CVE-2010-0140: Undefined Security Weakness

Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.02.3 hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create 1 user or 2 administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 a...

Jobscript4Web 3.5 - Multiple Cross-Site Request Forgery Vulnerabilities

Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link: http://www.jobscript4web.com/ Version: 3.5 CVE : /\ == \ /\ \ /\ \ \ \ input name="Submit" type=...

Easy Banner Pro Cross Site Request Forgery

/\ == \ /\ \ /\ \ \ \ inp...

Traidnt Discovery - [CSRF] Create Staff Account

No description provided by source. Exploit Title: Traidnt Discovery - CSRF Create Staff Account Date: 14-12-2009 Author: G0D-F4Th3r Software Link: http://discovery.traidnt.com/demo/ Version: 1.0 ====================================form================================================ html body...

Traidnt Discovery - Cross-Site Request Forgery (Create Staff Account)

Exploit Title: Traidnt Discovery - CSRF Create Staff Account Date: 14-12-2009 Author: G0D-F4Th3r Software Link: http://discovery.traidnt.com/demo/ Version: 1.0 ====================================form================================================ "/...

CVE-2009-3949

CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier (cp/profile.php). The root cause is missing administrative authentication for the donewauthor action, allowing remote attackers to create administrative accounts via the name, password, and conf_password parameters. Exploitation is net...

CVE-2009-1802: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact...

CVE-2009-1771

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the 1 usersfullname, 2 usersemail, 3 usersroleid, 4 usersusername, and 5 userspassword parameters...

CVE-2009-1771: Undefined Security Weakness

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the 1 usersfullname, 2 usersemail, 3 usersroleid, 4 usersusername, and 5 userspassword parameters...

CVE-2009-1670: Improper Authentication

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...