Papoo 1.0.3 - 'Plugin.php' Authentication Bypass

source: https://www.securityfocus.com/bid/24634/info Papoo is prone to an authentication-bypass vulnerability because the application fails to check user privileges when accessing the administration pages. An attacker can exploit this issue to gain access to administration plugins. This may lead ...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the administration of 1 polls, 2 profiles, 3 IP bans, and 4 forums in a web-app.org WebAPP 0.8 through 0.9.9.6; and b web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators...

CVE-2007-3416

Multiple cross-site request forgery CSRF vulnerabilities in the administration of 1 polls, 2 profiles, 3 IP bans, and 4 forums in a web-app.org WebAPP 0.8 through 0.9.9.6; and b web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators...

CVE-2007-3416

CVE-2007-3416 describes CSRF vulnerabilities in the administration interfaces (polls, profiles, IP bans, and forums) of WebAPP 0.8–0.9.9.6 (web-app.org) and WebAPP 0.9.9.3.3–2007 (web-app.net). The underlying issue is cross-site request forgery that lets remote attackers perform deletions with ad...

CVE-2007-3416

Multiple cross-site request forgery CSRF vulnerabilities in the administration of 1 polls, 2 profiles, 3 IP bans, and 4 forums in a web-app.org WebAPP 0.8 through 0.9.9.6; and b web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators...

Important: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that fix several security flaws are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to...

Key Focus Web Server crossite scripting

Crossite scripting with administration console...

CVE-2007-3416: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the administration of 1 polls, 2 profiles, 3 IP bans, and 4 forums in a web-app.org WebAPP 0.8 through 0.9.9.6; and b web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators...

[Full-disclosure] Papoo CMS 3.6 - Access Restriction Bypass

Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007 Product Papoo Content Management System Vulnerable Versions Papoo 3.6 and maybe prior Vendor Status The Vendor was notified and the issue was fixed. A patch is available at...

[SECURITY] Fedora 7 Update: phpPgAdmin-4.1.2-1.fc7

phpPgAdmin is a fully functional web-based administration utility for a PostgreSQL database server. It handles all the basic functionality as well as some advanced features such as triggers, views and functions stored procedures. It also has Slony-I support...

[EXPL] Microsoft Windows XVoice.dll and Xlisten.dll Buffer Overflow (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

iDefense Security Advisory 06.01.07: Symantec VERITAS Storage Foundation Administration Service DoS Vulnerability

Symantec VERITAS Storage Foundation Administration Service DoS Vulnerability iDefense Security Advisory 06.01.07 http://labs.idefense.com/intelligence/vulnerabilities/ June 01, 2007 I. BACKGROUND The VERITAS Storage Foundation is made up of the Veritas File System, Veritas Volume Replicator VVR...

phppgadmin-xss.txt

------=Part257544061665.1180272607070 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Synopsis: Multiple XSS Vulnerabilities Introduction: phpPgAdmin is a web-based administration tool for PostgreSQL. Details: phpPgAdmin...

[Full-disclosure] phpPgAdmin Multiple XSS Vulnerabilities

Synopsis: Multiple XSS Vulnerabilities Introduction: phpPgAdmin is a web-based administration tool for PostgreSQL. Details: phpPgAdmin doesn't correctly sanitize data in $SERVER array and most of the scripts make direct use of PHPSELF. PoC:...

Information disclosure

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...

Design/Logic Flaw

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2699

The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files...

CVE-2007-2698

Summary: CVE-2007-2698 affects BEA WebLogic Server 9.0 Administr ation Console. The issue allows an attacker to view plaintext Web Service attributes during configuration creation, potentially exposing sensitive credentials. The published CVSS v2 base score is 5.0 (Medium): Network access, low at...

CVE-2007-2699

The CVE-2007-2699 entry concerns BEA WebLogic Express/Server 9.0/9.1 where the Administration Console fails to enforce Domain Security Policies, allowing remote administrative users in the Deployer role to upload arbitrary files. The connected documents indicate an abuse scenario via the WebLogic...

CVE-2007-2698

The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information...