448 matches found
MyBB 1.6.x < 1.6.11 Multiple Vulnerabilities
Binary data 8613.prm...
Avira Service - Unvalidated CSRF Token Account Hijacking
Document Title: =============== Avira Service - Unvalidated CSRF Token Account Hijacking References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1301 View: https://www.youtube.com/watch?v=lJR8Hv5JnOI Release Date: ============= 2014-08-28 Vulnerability Laboratory ID VL-ID:...
Avira Service - Unvalidated CSRF Token Account Hijacking
Document Title: =============== Avira Service - Unvalidated CSRF Token Account Hijacking References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1301 View: https://www.youtube.com/watch?v=lJR8Hv5JnOI Release Date: ============= 2014-08-28 Vulnerability Laboratory ID VL-ID:...
phpyun设计缺陷可用别的账户money付款，清空别的账户money为0
简要描述： 后台在处理订单的时候，直接获取cookie中的uid，此uid可以伪造成他人的uid，导致可用他人的money付款。 经过测试，虽然自己并不能获得支付成功的积分，但是可以扣除他人账户余额。 详细说明： 漏洞文件\api\tenpay\index.php: $sql=$db-query"select from ".$dbconfig"def"."companyorder where orderid='$POSTdingdan'"; $row=mysqlfetcharray$sql; //通过订单编号获取点单价格 $userid=int$COOKIE'uid';...
Instasheep — Instagram Account Hacking Tool Released
Two days ago, we reported at The Hacker News about a critical issue in the most popular image and video sharing service, Instagram app for mobiles, that allows an attacker to hijack users’ account and successfully access private photos, delete victim's photos, edit comments and also post new...
HackerOne: Account Hijacking (Only rare case scenario)
Hi, This is a logical flaw in the application which may allow any arbitrary user to obtain account access of another user. Below is the exploit scenario which may lead to potential account takeover in certain circumstances: User changes email while he is logged in his own account Some wrong email...
CzarNews <= 1.20 (Account Hijacking) Remote SQL Injection Vuln
首先登陆一个CzarNews 1.20 版本的网站。 2. 打开登陆页面,然后在地址栏中输入 javascript:document.cookie="recook=' or ''=',' or ''='";void0; 随后刷新页面，接下来见证奇迹，你会惊奇的发现你处于了登陆状态。 3. 如果你输入以下代码在URL当中 javascript:c=document.cookie;p=c.substrc.lastIndexOf'='+1.split/%../;a lert"Login: " + p0 + "\nPass: " + p1;void0;...
phProfession 2.5 modules.php offset Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/10190/info Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported. Exploitation o...
Expinion.net News Manager Lite 2.5 category_news_headline.asp XSS
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...
IMHO Webmail 0.9x Account Hijacking Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5238/info A vulnerability has been reported in the IMHO Roxen webmail module which may enable a malicious user of the webmail system to gain access to the account of another user. This issue is due to an error in...
phProfession 2.5 modules.php jcode Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10190/info Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported. Exploitation o...
phpx 3.2.3 - Multiple Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/9569/info Multiple vulnerabilities were reported in PHPX. The specific issues include cross-site scripting, HTML injection and account hijacking via specially crafted cookies. These issues were reported to exist in PHPX...
phProfession 2.5 upload.php Direct Request Path Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/10190/info Multiple vulnerabilities were reported to exist in phProfession, which is a third-party module for PostNuke. Path disclosure, cross-site scripting and SQL injection vulnerabilities were reported. Exploitation o...
Protector System 1.15 blocker_query.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/10206/info Multiple vulnerabilities were reported to exist in Protector System, which is a third-party module for PHP-Nuke. Cross-site scripting and SQL injection vulnerabilities were reported. Exploitation of these issue...
Expinion.net News Manager Lite 2.5 news_sort.asp filter Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...
Olat CMS 7.8.0.1 - Persistent XSS
No description provided by source. Document Title: =============== Olat CMS 7.8.0.1 - Persistent Calender Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1125 Release Date: ============= 2013-10-27 Vulnerability Laboratory ID VL-ID:...
Protector System 1.15 b1 index.php SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/10206/info Multiple vulnerabilities were reported to exist in Protector System, which is a third-party module for PHP-Nuke. Cross-site scripting and SQL injection vulnerabilities were reported. Exploitation of these issue...
Expinion.net News Manager Lite 2.5 category_news.asp ID Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...
Expinion.net News Manager Lite 2.5 comment_add.asp XSS
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...
Expinion.net News Manager Lite 2.5 search.asp XSS
No description provided by source. source: http://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the...