513 matches found
PHPmotion <= 2.1 CSRF Vulnerability
No description provided by source. PHPmotion = 2.1 CSRF vulnerability Author: Ausome1 Email: [email protected] Website: http://www.enigmagroup.org Description: Change a member's password and/or email...
lulieblog 1.2 - Multiple Vulnerabilities
No description provided by source. LulieBlog 1.2 Multiple Remote Vulnerabilities Admin Auth Bypass, Upload File, Blind SQL Injection Author: Cod3rZ Site: http://cod3rz.helloweb.eu Site: http://devilsnight.altervista.org Date: 06/05/2008 dd/mm/yyyy Admin Auth Bypass: Modify Articles: send a reques...
Sourcebans <= 1.4.2 Arbitrary Change Admin Email Vulnerability
No description provided by source. Sourcebans PHP sb-callback.php Author: Mr. Anonymous ------ Vendor:http://www.sourcebans.com Affected Versions: = 1.4.2 ----- Exploit sb-callback lines 185-204: ------------- function ChangeEmail$aid, $email ...SNIP... $GLOBALS'db'-ExecuteUPDATE .DBPREFIX.admins...
iScripts MultiCart <= 2.4 - Persistent XSS / CSRF / XSS+CSRF Mass Accounts takeover
Exploit for php platform in category web applications Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery form nam...
HackerOne: Logical issues with account settings
earlier email was not allowed to change ,but now there is no verification on changing email. when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email.The worst part is hackone send...
iScripts MultiCart 2.4 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Cross-Site Scripting / Cross-Site Request Forgery / Mass Accounts Takeover
Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type...
iScripts MultiCart 2.4 Cross Site Request Forgery / Cross Site Scripting
Exploit Title : iScripts MultiCart same product id for which you submited the review. Cross-site request forgery input type=hidden size=30 maxlengt...
[waraxe-2012-SA#089] - Multiple Vulnerabilities in TorrentTrader 2.08
waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-89.html Description of vulnerable...
torrenttrader 2.08 - Multiple Vulnerabilities
torrenttrader 2.08 - Multiple Vulnerabilities waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web:...
TorrentTrader 2.08 XSS / Directory Traversal / Bypass Vulnerabilities
Exploit for php platform in category web applications waraxe-2012-SA089 - Multiple Vulnerabilities in TorrentTrader 2.08 =============================================================================== Author: Janek Vind "waraxe" Date: 17. September 2012 Location: Estonia, Tartu Web:...
BPSwoopo CSRF Vulnerability
Exploit for php platform in category web applications Exploit Title: BPSwoopo CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/bpswoopo-penny-auction-script-like-swoopo/27766/ Category:: webapps Demo : http://www.icloudcenter.net/demos/ICPenny/ Greetz: Inj3ct0r...
idev-TextAds 3.0 CSRF (change e-mail address)
Exploit for php platform in category web applications Exploit Title: idev-TextAds 3.0 CSRF change e-mail address Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/php-scripts/ad-management-programs/idevtextads-30-ad-rotator-sell-text-ads/ Category:: webapps Demo :...
CVE-2011-5074
Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via 1 userprofileedit.p...
cPanel Cross Site Request Forgery
. \ \ | | | / | \ | | / | \ \ / | |/ / / / \ | | \ |/ \ | | / /\ | \ | /\ / / / / / /// .ORG + Info================================================================= - Exploit Title: cPanel Coded By BHG Delete Database div class="...
CVE-2011-2978
Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address aka oldemail field for e-mail change notifications, which makes it easier for remote...
Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication
When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...
Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication
When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...
Diferior CMS 8.03 Cross Site Request Forgery
Date: Tue 13 Jul 2010 11:50:32 AM EEST Vendor: http://diferior.com/ Download: http://diferior.com/postfiles/news/diferior-8-03-released/Diferiorv8.03.tar.gz --- -= CSRF PoC 1 - Change Admin Password =- Diferior CMS 8.03 Multiple CSRF Vulnerabilities - Change Admin Password -= CSRF PoC 2 - Change...
Zikula Application Framework 1.2.2 Cross Site Request Forgery
Vulnerability ID: HTB22351 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinzikulaapplicationframework.html Product: Zikula Application Framework Vendor: Zikula Software Foundation Vulnerable Version: 1.2.2 and Probably Prior Versions Vendor Notification: 19 April 2010 Vulnerability Type: CSR...
Sourcebans <= 1.4.2 Arbitrary Change Admin Email Vulnerability
No description provided by source. Sourcebans PHP sb-callback.php Author: Mr. Anonymous ------ Vendor:http://www.sourcebans.com Affected Versions: = 1.4.2 ----- Exploit sb-callback lines 185-204: ------------- function ChangeEmail$aid, $email ...SNIP... $GLOBALS'db'-Execute"UPDATE...