3093 matches found
SQL injection in DefaultReferralManager
In confluence-core/confluence/src/java/com/atlassian/confluence/links/DefaultReferralManager.java the DefaultReferralManager class the deleteReferrersWithPrefix method is vulnerable to sql injection through the user controlled 'prefix' parameter. It is possible to exploit this issue as an Admin...
Zenphoto 1.4.3.2 Cross Site Scripting
------------------------- Affected products: ------------------------- Product : Zenphoto 1.4.3.2 and maybe older fixed in 1.4.3.3 Affected function: printPublishIconLink ---------- Details: ---------- The file admin-news-articles.php calls the function printPublishIconLink which generates HTML...
PT-2012-3635
Name of the Vulnerable Software and Affected Versions Wolf CMS versions 0.75 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests. This includes deleting users via the user id number to "admin/user/delete", deleting pages vi...
PT-2012-3636
Name of the Vulnerable Software and Affected Versions Wolf CMS versions 0.75 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the username, useremail, or userusername parameters in the wolfcms/admin/user/add endpoint. Recommendations For version...
CVE-2012-1897: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 delete users via the user id number to admin/user/delete; 2 delete pages via the page id number to admin/page/delete;...
CVE-2012-1898: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in wolfcms/admin/user/add in Wolf CMS 0.75 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 username, 2 useremail, or 3 userusername parameters...
ocPoral CMS 8.x | Cross Site Request Forgery (CSRF) Vulnerability
OVERVIEW ocPoral CMS 8.x and lower versions are vulnerable to Cross-site Request Forgery CSRF / XSRF. 2. PRODUCT DESCRIPTION ocPortal is the website Content Management System a CMS for building and maintaining a dynamic website. ocPortal's powerful feature-set means there's always a way to...
OpenDocMan 1.2.6.1 - Cross-Site Request Forgery (Password Change)
Exploit Title: OpenDocMan Password Change CSRF Date: 22/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.opendocman.com/ Software Link: https://github.com/downloads/opendocman/opendocman/opendocman-1.2.6.1.tar.gz Version: 1.2.6.1 Gr33Tz: @aviadgolan , @benhayak,...
Scrutinizer Default Credentials Check
The Scrutinizer install on the remote host is using default credentials for the 'admin' user. Using these credentials, it is possible to login and gain access to the back end administrative interface. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
CVE-2012-1936: Cross-Site Request Forgery (CSRF)
The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...
WordPress 3.3.1 Cross Site Request Forgery
+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wordpress 3.3.1 Multiple CSRF Vulnerabilities Date : 19-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...
admin/dev/usermacros.jsp lacks an XSRF token to add and remove user macros from Confluence.
admin/dev/usermacros.jsp does not require a csrf token to add and remove user macros from Confluence. This could allow an attacker to introduce a malicious user macro with 'bad' html and or javascript into a confluence instance through a csrf attack on an admin user...
havalite 1.0 <= CSRF Add Admin user
Exploit for php platform in category web applications » havalite 1.0 » --- Date : 29- 03- 2012 » --- Author : Expl0!Ts » --- Software Link : http://havalite.com/downloads/havalite.zip » --- Version: 1.0 » --- Category: php » --- Tested on: wind xp & ubuntu 10.10 » --- Dork : your mind 1- First Vu...
Wolfcms <= 0.75 CSRF / XSS Vulnerabilities
Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Wolfcms = 0.75 Multiple Vulnerabilities CSRF - XSS Date : 22-03-2012 Author : Ivano Binetti...
HP Data Protector Create New Folder Buffer Overflow
This module exploits a stack buffer overflow in HP Data Protector 5. The overflow occurs in the creation of new folders, where the name of the folder is handled in a insecure way by the dpwindtb.dll component. While the overflow occurs in the stack, the folder name is split in fragments in this...
Ad Manager Pro Cross Site Request Forgery
Exploit Title: Ad Manager Pro CSRF Vuln add admin Author: Jonturk75 Vendor of Software Link: http://www.scripts.com/viewscript/php-text-ad-management/20881/ Category:: webapps Demo site: http://www.scripts-demo.com/admanagerpro/administration/index.php...
HomeSeer HS2 and HomeSeer PRO - Multiple Vulnerabilities
HomeSeer Home Automation Software Multiple Web Vulnerabilities 0day Date: 3/6/12 Author: SilentDream Software Link: http://www.homeseer.com/pub/setuphs25049.exe Version: 2.5.0.49 Tested on: Win XP CERT VU796883: http://www.kb.cert.org/vuls/id/796883 Note: This affects both HomeSeer HS2 and HomeSe...
Yealink VOIP Phone Cross Site Scripting
============================================================== Secur-I Research Group Security Advisory SV-2012-005 ============================================================== Title: Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability Product: Yealink Easy VOIP Phone Homepage:...
ContaoCMS (aka TYPOlight) 2.11 - Cross-Site Request Forgery (Delete Admin / Delete Article)
+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ContaoCMS aka TYPOlight CSRF Exploit t...
