Barracuda CSRF (change e-mail address)

Exploit for php platform in category web applications Exploit Title: Barracuda CSRF change e-mail address Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/barracuda/19576/ Category:: webapps Demo : http://demo.boonex.com/administration/ Greetz: Inj3ct0r Exploit DataBas...

CVE-2011-4189

The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption and application crash via a long e-mail address in an Address Book aka .NAB file...

Novell Groupwise Address Book Remote Code Execution

Exploit for windows platform in category dos / poc Application: Novell Groupwise Address Book Remote Code Execution Platforms: Windows Exploitation: Remote code execution CVE Number: 2011-4189 Novell TID: 733885 PRL: 2012-04 Author: Francis Provencher Protek Research Lab's Website:...

CVE-2012-0448

Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by...

CVE-2012-0448

Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by...

CVE-2011-4760: Exposure of Sensitive Information to an Unauthorized Actor

Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by...

PT-2011-5090

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue allows remote attackers to obtain potentially sensitive information by reading certain web pages, such as "smb/email-address/list" and other files, which contain e-mail...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

Sql injection

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4555

CVE-2011-4555 affects One Click Orgs prior to version 1.2.3. The issue is that user accounts do not require unique e-mail addresses, enabling remote authenticated users to cause login disruption (denial of service) or to spoof votes/comments by selecting a conflicting e-mail address. Root cause: ...

CVE-2011-4555: Undefined Security Weakness

One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service login disruption or spoof votes or comments by selecting a conflicting e-mail address...

Linux Foundation & Linux.com multiple server compromised

Linux Foundation & Linux.com multiple server compromised The Linux Foundation has pulled its websites from the web to clean up from a "security breach". A notice posted on the Linux Foundation said the entire infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down f...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using $usercount for the boolean condition checking :...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: The following security issues have been discovered in Bugzilla: Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in "Raw Unified" mode, which could trigger a cross-site scripting attack due to the execution of...

PayPal vulnerability : Hack any Paypal account within 30 seconds

PayPal vulnerability : Hack any Paypal account within 30 seconds UPDATE : This has been debunked, Paypal accounts are safe. https://thenextweb.com have spoken in depth to Matt Langley, the person who discovered the supposed issue, and it's clear why he assumed there was a serious security breach...

JVN#40382909: Microsoft Outlook read receipt function vulnerability

Microsoft Outlook contains a vulnerability in the read receipt function. A read receipt may be sent unintentionally, notifying the sender that the email was received. Impact A spam distributor may use this information to determine whether an email address is valid or not. Solution Upgrade the...

IBM Lotus Domino iCalendar Email Address ORGANIZER:mailto Header Remote Overflow

According to its self-reported version, the remote SMTP service is an instance of IBM Lotus Domino that is is affected by a remote stack-based buffer overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. Successfully exploiting this issue may allow...

Design/Logic Flaw

Open Ticket Request System OTRS before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field...

Facebook new Vulnerability, Lots of Accounts misused for spamming !

Facebook new Vulnerability, Lots of Accounts misused for Spamming ! Facebook New Vulnerability, This time Facebook Groups are Vulnerable , One by one we getting more on more bugs in Facebook. Last days their was lots of bugs in Facebook page, because of that lots of big pages got hacked, Now 1000...