PYSEC-2014-39

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

Wordpress Plugin CSSJockey Membership Modules Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Plugin CSSJockey Membership Modules Code Execution Vulnerability Exploit Author : NULLPointer Contact : https://www.facebook.com/xenith.gianni Date : 20/09/2014 Vendor Homepage :...

(Plone): Anonymous users can list user account names

It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names...

PT-2014-2324 · Plone Foundation +1 · Plone +1

Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone versions 4.3 prior to beta 1 Description: The issue allows remote attackers to enumerate user account names via a crafted URL. This is related to the membership tool.py script. Recommendations: For Plone...

CVE-2014-3553

The vulnerability CVE-2014-3553 affects Moodle pre-2.7.1 releases (2.3.11; 2.4.x <2.4.11; 2.5.x <2.5.7; 2.6.x <2.6.4; 2.7.x

Membership Script Multiple Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/31441/info Membership Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code i...

PHP Membership Manager 1.5 Admin.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22263/info PHP Membership Manager is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script...

PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit

No description provided by source. !/usr/bin/perl Note: adduser.php is accessable to a guest/any-user, but if you access through a browser you cant add admin, theres a hidden POST buried in the script, which contains the userlevel. Note: alot of sites run this script and they remove the powered b...

Ollance Member Login Script Multiple Vulnerabilities

No description provided by source. Exploit Title: Ollance login script Multiple Vulnerabilities Vendor: www.ollance.com Date: 1st july,2011 Author: $4d0//r007k17 a.k.a Raghavendra Karthik [email protected],NITK Google Dork: Powered by Ollance Member Login Script BRIEF DESCRIPTION Ollance...

Membership Site Script SQL Injection Vulnerability

No description provided by source. :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = Membership Site Script SQL Injection Vulnerability Author = Valentin Hoebel Contact = [email protected]...

Deonixscripts Templates Management 1.3 - SQL Injection Vulnerability

No description provided by source. -------------------------------------------------------------------------- Deonixscripts Templates Management Version 1.3 SQL Injection Vulnerability -------------------------------------------------------------------------- + Author : d3b4g + Email :...

Active Membership 2 - (Auth Bypass) Remote SQL Injection Vulnerability

No description provided by source. ----------------------------بسم الله الرحمن الرحيم------------------------------ Tybe:Auth Bypass Remote SQL Injection Vulnerability Vendor: www.activewebsoftwares.com Software: Active Membership v 2 author: я3d D3v!L Date: 28.11.2008 Home: www.ahacker.biz...

Ocean12 Membership Manager Pro Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13046/info Ocean12 Membership Manager Pro is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverag...

PEHEPE Membership Management System 3.0 - Sol_menu.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16885/info PEHEPE Membership Management System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this...

Removing user from LDAP doesn't clear LDAP group membership

Reproduction steps: 1. Setup generic LDAP user repository RW, with jira-users, jira-developers, jira-administrators groups. 2. Create user for John Smith as [email protected]. 3. Add him to jira-administrators group. 4. Remove user [email protected] John changed the company. 5. Create user for Jake Sunny as...

Removing user from LDAP doesn't clear LDAP group membership

Reproduction steps: 1. Setup generic LDAP user repository RW, with jira-users, jira-developers, jira-administrators groups. 2. Create user for John Smith as [email protected]. 3. Add him to jira-administrators group. 4. Remove user [email protected] John changed the company. 5. Create user for Jake Sunny as...

Removing user from LDAP doesn't clear LDAP group membership

Reproduction steps: 1. Setup generic LDAP user repository RW, with jira-users, jira-developers, jira-administrators groups. 2. Create user for John Smith as [email protected]. 3. Add him to jira-administrators group. 4. Remove user [email protected] John changed the company. 5. Create user for Jake Sunny as...

CVE-2014-0249

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...

DEBIAN-CVE-2014-0249

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...

CVE-2014-0249

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...