CVE-2018-17147

Nagios XI before 5.5.4 has XSS in the auto login admin management page...

CVE-2018-17147

Nagios XI prior to version 5.5.4 contains a Cross-Site Scripting (XSS) vulnerability in the Auto-Login administrator management page. The root cause is described as insufficient validation of client-side data in the web application. Impact details in the provided sources indicate client-side code...

CVE-2018-17146

A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page...

Auto Login URL - Less Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-034

This module lets you create auto login URLs programmatically on demand and through tokens. The module does not provide sufficient protection when generating login URLs. An attacker could rebuild login URLs independently thereby logging in as another user. This vulnerability is mitigated by the fa...

ATutor 2.2 Session Variable Overloading Vulnerability

ATutor versions 2.2 and below suffer from a session variable overloading vulnerability. ---------------------------------------------------------------------- ATutor = 2.2 confirm.php Session Variable Overloading Vulnerability ----------------------------------------------------------------------...

eFront 3.6.15.2 Cross Site Request Forgery

Advisory: Multiple CSRF vulnerabilities in eFront v. 3.6.15.2 CE Advisory ID: SROEADV-2015-09 Author: Steffen Rösemann Affected Software: eFront v. 3.6.15.2 CE Release-date: 05-Dec-2014, build 18021 Vendor URL: http://www.efrontlearning.net Vendor Status: patched CVE-ID: - Tested with/on: -Browse...

Pandora FMS SQL Injection Remote Code Execution Vulnerability

This Metasploit module attempts to exploit multiple issues in order to gain remote code execution under Pandora FMS versions equal to and prior to 5.0 SP2. First, an attempt to authenticate using default credentials is performed. If this method fails, a SQL injection vulnerability is leveraged in...

Bypassing Google Two Factor Authentication

Duo Security found a loophole in Google's authentication system that allowed them to Google's two factor authentication and gain full control over a user's Gmail account by abusing the unique passwords used to connect individual applications to Google accounts. Duo Security itself a two-factor...

Bypassing Google Two Factor Authentication

Duo Security found a loophole in Google's authentication system that allowed them to Google's two factor authentication and gain full control over a user's Gmail account by abusing the unique passwords used to connect individual applications to Google accounts. Duo Security itself a two-factor...

Researchers Bypass Google Two-Factor Authentication

For some time, attackers had the ability to bypass Google’s two-step authentication system through access to users’ app-specific passwords, giving them full access to victims’ Google accounts, including Gmail. The vulnerability that enables this attack, discovered by researchers from DuoSecurity,...

Cybershade CMS 0.2b Session Hijacking PoC Vulnerability

Exploit for unknown platform in category web applications ======================================================= Cybershade CMS 0.2b Session Hijacking PoC Vulnerability ======================================================= p0c!: Session Hijacking Cybershade CMS 0.2b Session Hijacking PoC...

woltlab3-xsrf.txt

WoltLab Burning Board 3.x.x PM Delete Cross-Site Request Forgery Vulnerability by NBBN. Founded: 25 December 2007 Examples: http://domain.tld/wbb3/index.php?page=PM&action=delete&pmID=pmid http://domain.tld/wbb3/index.php?page=PM&action=delete&pmID=1 Fix: Wait for a fix. Or never surf in other...

SuSE 10 Security Update : KDE (ZYPP Patch Number 4433)

Users could log in as root without having to enter the password if auto login was enabled and if kdm was configured to require the root passwort to shutdown the system. CVE-2007-4569 JavaScript code could modify the URL in the address bar to make the currently displayed website appear to come fro...

GLSA-200710-15 : KDM: Local privilege escalation

The remote host is affected by the vulnerability described in GLSA-200710-15 KDM: Local privilege escalation Kees Huijgen discovered an error when checking the credentials which can lead to a login without specifying a password. This only occurs when auto login is configured for at least one user...

CVE-2006-3772

The CVE-2006-3772 entry concerns PHP-Post versions 0.21 and 1.0 (and possibly earlier) where, when auto-login is enabled, an attacker can bypass security restrictions and obtain administrative privileges by modifying the logincookie[user] value in the login cookie. The connected sources confirm t...

invision203Login.pl.txt

!/usr/bin/perl -w This one actually works : Just paste the outputted cookie into your request header using livehttpheaders or something and you will probably be logged in as that user. No need to decrypt it! Exploit coded by "Tony Little Lately" and "Petey Beege" use LWP::UserAgent; $ua = new...

phpBB 2.0.12 - Change User Rights Authentication Bypass

phpBB 2.0.12 - Change User Rights Authentication Bypass !/usr/bin/perl -w phpBB new ; my $cookiejar = HTTP::Cookies-new ; $browser-cookiejar $cookiejar ; $cookiejar-setcookie "0","phpbb2mysqldata", "a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D",...