Improper access control

The "Make a backup" functionality in Content Management Made Easy CMME 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover 1 account names and 2 password hashes via a direct request for a backup/cmmedata.zip or b...

CVE-2008-3925

Cross-site request forgery CSRF vulnerability in admin.php in Content Management Made Easy CMME 1.12 allows remote attackers to trigger the logout of an administrative user via a logout action...

CVE-2008-3924

Content Management Made Easy (CMME) 1.12 exposes sensitive data under the web root via its Make a backup feature, allowing remote attackers to directly request backup/cmme_data.zip or backup/cmme_cmme.zip to discover account names and password hashes. Vector a reportedly also affects CMME 1.19. T...

Docebo GLOBALS Variable Overwrite Vulnerability (Aug 2008)

Docebo is prone to vulnerable remote and local file inclusion vulnerabilities. SPDX-FileCopyrightText: 2008 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only Original...

[SECURITY] Fedora 8 Update: drupal-5.9-1.fc8

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

PHPX 3.5.16 Cookie Poisoning and Login Bypass Vulnerability

No description provided by source. ======================================================================= = gnix = gnixmail at gmail dot com http://gnix.netsons.org Application: phpx http://www.phpx.org/project.php stable version Versions: 3.5.16 Platforms: All Bug: Cookie poisoning / Login bypa...

PHPX 3.5.16 - Cookie Poisoning Authentication Bypass

PHPX 3.5.16 - Cookie Poisoning Authentication Bypass ======================================================================= = gnix = gnixmail at gmail dot com http://gnix.netsons.org Application: phpx http://www.phpx.org/project.php stable version Versions: 3.5.16 Platforms: All Bug: Cookie...

PHPX 3.5.16 - Cookie Poisoning / Authentication Bypass

======================================================================= = gnix = gnixmail at gmail dot com http://gnix.netsons.org Application: phpx http://www.phpx.org/project.php stable version Versions: 3.5.16 Platforms: All Bug: Cookie poisoning / Login bypass Date: 31 July 2008...

fuzzylime (cms) comssrss.php files[] Parameter Traversal Local File Inclusion

The remote host is running fuzzylime cms, a PHP-based content management system. The version of fuzzylime cms installed on the remote host fails to sanitize user-supplied input to the 'files' parameter of the 'commsrss.php' script before using it to include PHP code. Regardless of PHP's...

[SECURITY] Fedora 8 Update: drupal-5.8-1.fc8

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 9 Update: drupal-6.3-1.fc9

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Pluck 4.5.1 (blogpost) Local File Inclusion Vulnerability (win only)

Exploit for unknown platform in category web applications ==================================================================== Pluck 4.5.1 blogpost Local File Inclusion Vulnerability win only ==================================================================== AmnPardaz Security Research Team...

Wind noise CMS4. 0sp5 commercial version of the fatal-vulnerability warning-the black bar safety net

Article author: oldjun&flyh4t script security team Information source: evil octal information security team www.eviloctal.com） Note: the article has been published in the hackers Handbook, by the author of friendship submitted to the evil octal information security team technology Forum, reproduc...

TGS Content Management 0.3.2r2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30157/info TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script co...

TGS Content Management 0.3.2r2 - login.php Multiple Cross-Site Scripting Vulnerabilities

TGS Content Management 0.3.2r2 - login.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30157/info TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize...

TGS Content Management 0.3.2r2 - 'login.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30157/info TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script co...

phPortal 1.2 Multiple Remote File Inclusions Exploit

Exploit for unknown platform in category web applications ==================================================== phPortal 1.2 Multiple Remote File Inclusions Exploit ==================================================== !/usr/bin/perl phportal1.2Beta gunaysoft.php Remote File Include Vulnerability...

PHPortal 1.2 - Multiple Remote File Inclusions

PHPortal 1.2 - Multiple Remote File Inclusions !/usr/bin/perl phportal1.2Beta gunaysoft.php Remote File Include Vulnerability Discovered by : Ciph3r Class: Remote File Include Vulnerability exemplary Exp: http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?icerikyolu=shell...

Debian Security Advisory DSA 1596-1 (typo3)

The remote host is missing an update to typo3 announced via advisory DSA 1596-1. OpenVAS Vulnerability Test $Id: deb15961.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1596-1 typo3 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Debian: Security Advisory (DSA-1596-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...