1542 matches found
Design/Logic Flaw
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors...
CVE-2013-3981
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors...
Avatars appear on Activity Stream even for anonymous users
Every user, independent of privileges, is able to see entries related to user's avatar change on Activity Stream. It also happens for users that are not logged in. See attached image...
User avatar upload endpoint is vulnerable to XSRF
Stash, as 2.12, will allows users to upload local avatars to their account STASHDEV-6182. That upload is submitted to a non-API end point that accepts a POST request with the avatar as data-uri|https://en.wikipedia.org/wiki/DataUri. Currently, because the form is submitted by AJAX, the end point ...
Administrator can change avatar without establishing a Secure Administrator Session (WebSudo)
Administrator can click on avatar of another user and change the avatar. This doesn't require the administrator user to establish a websudo session...
Administrator can change avatar without establishing a Secure Administrator Session (WebSudo)
Administrator can click on avatar of another user and change the avatar. This doesn't require the administrator user to establish a websudo session...
Tipask 2.0 front arbitrary file deletion vulnerability-vulnerability warning-the black bar safety net
Brief description: tipask you can adjust the picture save and delete the original avatar Delete the original avatar used when a post submission parameters Result in arbitrary file deletion vulnerability Detailed description: function onsaveimg $x1 = $this- post'x1' ; $y1 = $this- post'y1' ; $x2 =...
Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication
Early 2012 ESET company a mysterious malware, dubbed the Avatar rootkit Win32/Rootkit.Avatar, advertised in the underground forums by Russian cyber crime. "We present you here previously announced product. In connection with work on other projects, we moved the release date for the public from Ma...
Mysterious Avatar rootkit with API, SDK, and Yahoo Groups for C&C communication
Early 2012 ESET company a mysterious malware, dubbed the Avatar rootkit Win32/Rootkit.Avatar, advertised in the underground forums by Russian cyber crime. "We present you here previously announced product. In connection with work on other projects, we moved the release date for the public from Ma...
Responsive Article Directory Script Shell Upload Vulnerability
Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...
JEECMS the latest vulnerability, File Upload-a vulnerability warning-the black bar safety net
Vulnerability description: this vulnerability is very simple, the upload is not filtered, register an account after that go to upload an avatar, the jsp can be, you will be prompted to upload the wrong type, the pop-up dialog box, do not ignore it, close the popups, right click to view source cod...
AwAuctionScript (Aw Auction Script - Market Place for WebMasters) Multiple Vulnerabilities
========================================================================================== AwAuctionScript Aw Auction Script - Market Place for WebMasters Multiple Vulnerabilities ==========================================================================================...
CVE-2011-5133
Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...
Design/Logic Flaw
Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...
CVE-2011-5133
CVE-2011-5133 affects MyBB
CVE-2011-5133
Unspecified vulnerability in MyBB before 1.6.5 has unknown impact and attack vectors, related to an "unparsed user avatar in the buddy list."...
WordPress Cimy User Extra Fields 2.3.7 Shell Upload
Exploit Title: wordpress plugin Cimy User Extra Fields Arbitrary File Upload Vulnerability Google Dork: inurl:"inurl:/wp-content/CimyUserExtraFields" Date: 07/18/2012 Author: Crim3R plugin download Link : http://downloads.wordpress.org/plugin/cimy-user-extra-fields.2.3.7.zip Version: 2.3.7 Tested...
Arbitrary File Upload/Execution in Collabtive
TITLE: Arbitrary File Upload/Execution in Collabtive DATE: 06-04-2012 PRODUCT: Collabtive Web-Based Project Management Software http://collabtive.o-dyn.de/ VERSIONS: 0.7.5, 0.6.1 confirmed. All versions = 0.7.5 probable RESEARCHER: Mark Hoopes [email protected]/ ADDITIONAL INFORMATION:...
PBBoard 2.1.4 - Multiple SQL Injections
PBBoard 2.1.4 - Multiple SQL Injections Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities Version: 2.1.4 Author/Found by: loneferret Software Site: http://www.pbboard.com/PBBoardv2.1.4.zip Other vulnerabilities: http://www.exploit-db.com/exploits/18937/ Date found: May 29th 2012 Tested on: Ubun...
PBBoard 2.1.4 SQL Injection
Title: PBBoard v2.1.4 multiple SQLi Vulnerabilities Version: 2.1.4 Author/Found by: loneferret Software Site: http://www.pbboard.com/PBBoardv2.1.4.zip Other vulnerabilities: http://www.exploit-db.com/exploits/18937/ Date found: May 29th 2012 Tested on: Ubuntu Server 8.04 / PHP Version...