Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Carbon Black before 4.1.0 allow remote attackers to hijack the authentication of administrators for requests that add new administrative users and have other unspecified action, as demonstrated by a request to api/user...

WordPress Quick Page/Post Redirect Plugin 5.0.3 - Multiple Vulnerabilities

WordPress Quick Page/Post Redirect plugin is prone to multiple vulnerabilities, such as CSRF and XSS. Because of this vulnerabilities, an admin user can be persuaded to visit a URL of the attacker’s choosing, the attacker can insert arbitrary JavaScript into an admin page. In that way the admin's...

PHPJabbers Pet Listing Script 1.0 - Multiple Vulnerabilities

PHPJabbers Pet Listing Script 1.0 - Multiple Vulnerabilities Pet Listing Script V1.0 - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Appointment Scheduler 2.0 XSS / CSRF / File Disclosure

Appointment Scheduler V2.0 - Multiple Vulnerabilties ========================================================================= .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.phpjabbers.com/appointment-scheduler/ .:. Tested On Demo ...

[Full-disclosure] Magnolia CMS multiple access control vulnerabilities

Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ====== CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...

Cross site scripting

Cross-site scripting XSS vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag...

Alt-N MDaemon WebAdmin Remote Code Execution

================================================================== Alt-N MDaemon's WebAdmin Remote Code Execution Vulnerability ================================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/ Vuln Type: Remote Code...

Fedora 18 : system-config-date-1.10.3-1.fc18 / system-config-nfs-1.4.1-1.fc18 (2012-17797)

This updates tightens policy so that only administrative users can make changes to the system as it was before using pkexec instead of consolehelper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user...

Multiple vulnerabilities in LogAnalyzer

Advisory ID: CSA-12005 Title: Multiple vulnerabilities in LogAnalyzer Product: LogAnalyzer Version: 3.4.2 and probably prior Vendor: adiscon.com Vulnerability type: SQL injection, XSS, Arbitrary File Read Risk level: 2 / 3 Credit: www.codseq.it CVE: Vendor notification: 2012-05-21 Public...

Lynx Message Server - Multiple Vulnerabilities

Lynx Message Server - Multiple Vulnerabilities 1. Summary The Micro Technology Services Inc. "Lynx Message Server 7.11.10.2" and/or "LynxTCPService version 1.1.62" web interface is vulnerable to SQL Injection, Cross-Site Scripting, and other security problems. 2. Description Lynx is a "Facility...

Fingerprint And Proximity Access Control Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 + Device: Fingerprint & Proximity Access Control + Model: ZEM560 and others + Kernel: 2.6.24 Treckle on an MIPS + Vulnerability: Auth Bypass + Impact: By using a direct URL attackers can bypass the fingerprint & proximity security and open the door...

Postfixadmin 2.3.4 SQL Injection / Cross Site Scripting

Advisory ID: CSA-12002 Title: Multiple vulnerabilities in postfixadmin Product: postfixadmin Version: 2.3.4 and probably prior Vendor: www.postifixadmin.org Vulnerability type: SQL injection, XSS Vendor notification: 2012-01-10 Public disclosure: 2012-01-26 postfixadmin version 2.3.4 and probably...

Oracle WebLogic Admin State Unspecified Privilege Escalation (CVE-2008-4011)

According to its self-reported banner, the version of Oracle WebLogic Server running on the remote host is affected by an unspecified privilege escalation vulnerability such that some applications in admin state are made available to non-admin users. %NASLMINLEVEL 70300 C Tenable Network Security...

Parliament Of Botswana hacked by V0iD

Parliament Of Botswana hacked by V0iD V0iD hacker again strike with Parliament Of Botswana . Hacker Releases the database table information and Admin users login details at . Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post...

WebsiteBaker 2.8.1 Path Disclosure / SQL Injection

=================================== Vulnerability ID: HTB22929 Reference: http://www.htbridge.ch/advisory/multiplepathdisclosureinwebsitebaker.html Product: WebsiteBaker Vendor: Website Baker Org http://www.websitebaker2.org/ Vulnerable Version: 2.8.1 Vendor Notification: 29 March 2011...

Free Simple Software SQL Injection

'Free Simple Software' SQL Injection Vulnerability CVE-2010-4298 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in the 'Free Simple Software' download module which allows for a 'UNION SELECT' to easily expose the application...

CMS Ignition - SQL Injection

CMS Ignition - SQL Injection |------------------------------------------------| | neavorc@gmaildotcom | ================================================== + SQL Injection Vulnerability + Dorks: allinurl:"shop.htm?shopMGID=" + Bug in shop.htm?shopMGID + Exploit:...

CMS Ignition SQL Injection Exploit

Exploit for php platform in category web applications ================================== CMS Ignition SQL Injection Exploit ================================== + SQL Injection Vulnerability + Dorks: allinurl:"shop.htm?shopMGID=" + Bug in shop.htm?shopMGID + Exploit:...

CVE-2010-2039

Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...