CVE-2009-1826

modules/admuser.php in myGesuad 0.9.14 aka 0.9 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action...

CVE-2009-1825

modules/admuser.php in myColex 1.4.2 does not require administrative authentication, which allows remote authenticated users to list user accounts via a Find action...

CVE-2009-1826

The CVE-2009-1826 entry affects myGesuad 0.9.14 (aka 0.9). The vulnerability is that modules/admuser.php does not require administrative authentication, enabling remote authenticated users to list user accounts via a Find action. This is the explicit root cause and impact stated in multiple sourc...

CVE-2009-1802

The CVE-2009-1802 entry describes multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX, affecting versions including 2.5.1 and other 2.4.x, 2.5.x, and pre-release 2.6.x. The underlying issue allows remote attackers to hijack the authentication of admins for requests that create a...

TCPDB Security Bypass Vulnerability

This host is installed with TCPDB and is prone to security bypass vulnerability. OpenVAS Vulnerability Test $Id: secpodtcpdbsecbypassvuln.nasl 5122 2017-01-27 12:16:00Z teissa $ TCPDB Security Bypass Vulnerability Authors: Nikita MR Copyright: Copyright c 2009 SecPod, http://www.secpod.com This...

Session fixation

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors...

CVE-2009-1634

The WebAccess component in Novell GroupWise 7.x before 7.03 HP3 and 8.x before 8.0 HP2 does not properly implement session management mechanisms, which allows remote attackers to gain access to user accounts via unspecified vectors...

Authentication flaw

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the 1 usersfullname, 2 usersemail, 3 usersroleid, 4 usersusername, and 5 userspassword parameters...

Authentication flaw

admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...

CVE-2009-1767

CVE-2009-1767 involves admin/edituser.php in the 2daybiz Template Monster Clone, where no administrative authentication is required. This permits remote attackers to modify arbitrary accounts via the parameters loginname, password, email, firstname, and lastname. The NVD lists a CVSSv2 base score...

CVE-2009-1771

CVE-2009-1771 affects Flyspeck CMS 6.8, where the updateExistingContent action does not require administrative authentication. This enables remote attackers to create or modify admin accounts by manipulating parameters: users[fullname], users[email], users[role_id], users[username], and users[pas...

CVE-2009-1670

user/index.php in TCPDB 3.8 does not require administrative authentication, which allows remote attackers to add admin accounts via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-1670

TCPDB 3.8 is vulnerable to a security bypass where user/index.php does not require administrative authentication, allowing remote attackers to add admin accounts via unspecified vectors. This is documented in multiple sources (NVD entry CVE-2009-1670 and OpenVAS entries) with CVSS base score 7.5 ...

CVE-2009-1665

myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields...

Code injection

myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields...

CVE-2009-1665

CVE-2009-1665 affects myaccount.php in Easy Scripts Answer and Question Script. The issue allows remote attackers to remove arbitrary user accounts by modifying the userid parameter without supplying additional fields. This indicates an input manipulation vulnerability in the account-management l...

CVE-2009-1665

myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields...

Oracle Database password weakness

Added: 05/12/2009 Background Oracle Database is a relational database solution available for multiple platforms. Problem The Oracle Database service has accounts with default or easily guessed passwords, which could allow an attacker to make unauthorized SQL queries. Resolution Set a strong...

MySQL password weakness

Added: 05/11/2009 Background MySQL is an open-source database software package available for multiple platforms. Problem A MySQL database account has no password or an easily guessed password, allowing a remote attacker to make unauthorized queries. Resolution Set a strong password for all MySQL...

Botnet hijack: Researchers dissect Torpig malware operation

Security researchers at University of California, Santa Barbara have broken into the nerve center of the Torpig botnet also called Sinowal or Mebroot to find a ten-day stash of 10,000 bank accounts and credit card numbers worth hundreds of thousands of dollars. During the botnet hijack .pdf, the...