CVE-2012-4490: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 user name or 2 email address...

cPanel Pro 11.32.5.11 Cross Site Request Forgery

============================================================================== Vulnerable Software: cPanel version : 11.32.5 build 11-11.32.5.11 cPanel Pro Vulnerability: CSRF Vendor: cpanel.net ==============================================================================...

CVE-2012-1588

Removed by vendor...

Code injection

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

CVE-2012-2991: Undefined Security Weakness

The PayPal aka MODULEPAYMENTPAYPALSTANDARD module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self...

Code injection

MemberProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address ID of another user...

Better WP Security v3.4.3 Wordpress - Web Vulnerabilities

Document Title: =============== Better WP Security v3.4.3 Wordpress - Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=691 Release Date: ============= 2012-08-20 Vulnerability Laboratory ID VL-ID: ==================================== 6...

Better WP Security v3.4.3 Wordpress - Web Vulnerabilities

Document Title: =============== Better WP Security v3.4.3 Wordpress - Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=691 Release Date: ============= 2012-08-20 Vulnerability Laboratory ID VL-ID: ==================================== 6...

PT-2012-4743

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call in the comment...

CVE-2012-0795

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address...

CVE-2012-0795

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address...

CVE-2012-0795

Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address...

CVE-2011-4289

Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...

PT-2012-5033

Name of the Vulnerable Software and Affected Versions Baby Gekko versions 1.2.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including username, email address, password, password verify, firstname, lastname, or verificati...

Fedora 17 : thunderbird-13.0-1.fc17 / thunderbird-lightning-1.5-2.fc17 (2012-9001)

What is new : - Filelink: Upload your files to an online storage service and send links to your friends, avoiding bounce back due to large attachments. We have partnered with YouSendIt to bring this feature, but additional partners will be added in the near future. - In partnership with Gandi and...

Liferay Portal 6.1.0 User Enumeration

The version of Liferay Portal hosted on the remote web server contains a flaw in the 'SearchPermissionCheckerImpl' class's 'doGetPermissionQuery' method that allows a remote, unauthenticated attacker to enumerate all user accounts. It may be possible to determine the email address of each of the...

lifetype 1.2.11 CSRF Add User

Exploit for php platform in category web applications +---------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title := lifetype 1.2.11 CSRF Add User Date := 05/april/2012 Author := khaled-Ham Software link :...

Novell GroupWise Client Address Book File Handling Email Address Field Remote Overflow

The version of Novell GroupWise Client 8.x installed on the remote Windows host is earlier than 8.0.2 post-HP3. As such, it is reportedly affected by a buffer overflow vulnerability when parsing an Address Book .nab file with an overly long email address. By tricking a user into opening a special...

PT-2012-3532

Name of the Vulnerable Software and Affected Versions SocialCMS version 1.0.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the TREF email address or TR name parameters in t...

Dating Pro CSRF (change e-mail address)

Exploit for php platform in category web applications Exploit Title: Dating Pro CSRF change e-mail address Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/dating-pro/21517/ Category:: webapps Demo : http://demo.datingpro.com/dating/admin Greetz: Inj3ct0r Exploit...