CVE-2011-3436

Open Directory in Apple Mac OS X 10.7 before 10.7.2 does not require a user to provide the current password before changing this password, which allows remote attackers to bypass intended password-change restrictions by leveraging an unattended workstation...

CVE-2011-3436

CVE-2011-3436 affects Open Directory on OS X Lion (10.7 and 10.7.1). A password-change access-control flaw allows an unauthenticated bypass where a user can change another account’s password without providing the current one, exploitable via an unattended workstation. The issue is documented in A...

Apple Mac OSX (Lion) - Directory Services Security Bypass

Apple Mac OSX Lion - Directory Services Security Bypass source: https://www.securityfocus.com/bid/49676/info Apple Mac OS X Lion is prone to multiple security-bypass vulnerabilities. Local attackers can exploit these issues to obtain sensitive information or change the password of other users on...

Apple Mac OSX (Lion) - Directory Services Security Bypass

source: https://www.securityfocus.com/bid/49676/info Apple Mac OS X Lion is prone to multiple security-bypass vulnerabilities. Local attackers can exploit these issues to obtain sensitive information or change the password of other users on the computer, without sufficient privileges. $ dscl...

Google tells Iranians to Change their Gmail password

Google tells Iranians to Change their Gmail password Google is advising all its users in Iran to change their Gmail passwords, and check that their Google accounts have not been compromised.In a blog post, Google said that it was directly contacting users in Iran who may have been hit by a...

Mambo 4.6.5 CSRF Vuln (Change Admin Password)

Exploit for php platform in category web applications ===================================================================== . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Exploit Information Disclosure Web :...

V5shop injection vulnerability-vulnerability warning-the black bar safety net

Vulnerability to harm: the high-risk A vulnerability file: cart. aspx Search keywords: inurl:scoreindex. aspx exp: the /cart. aspx? act=buy&id=1 and Select Top 1 char1 2 4%2BisNullcastName as varchar8 0 0 0,char3 2%2Bchar1 2 4%2BisNullcastPass as varchar8 0 0 0,char3 2%2Bchar1 2 4 From Select Top...

SuSE 10 Security Update : glibc (ZYPP Patch Number 7659)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods. CVE-2011-2483 SUSE's crypt implementation supports the blowfish password hashing...

oscommerce online merchant v2.2 rc2 - [CSRF] Change admin and pass

Exploit for php platform in category web applications Exploit Title: oscommerce online merchant v2.2 rc2 - CSRF Change name admin and pass Author: Dmar al3noOoz Mail : email protected Name : oscommerce online merchant v2.2 rc2 dork : Google Dork: "oscommerce online merchant v2.2 rc2" Software Lin...

Indian shopping website Groupon leaks Email/Passwords of 300,000 Users

Indian shopping website Groupon leaks Email/Passwords of 300,000 Users Groupon subsidary – Sosata.com leak the e-mail addresses and plain-text passwords for 300,000 users and also the sql file is index on Google. SoSasta.com offers its services in 11 cities - Kolkata, Hyderabad, Pune, Ahmedabad,...

ManageEngine ServiceDesk Plus Default Administrator Credentials

The remote ManageEngine ServiceDesk Plus install uses a default set of credentials 'administrator' / 'administrator' to control access to its management interface. With this information, an attacker can gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security,...

eFront Community++ <= XSRF (Add admin/change admin passwd)

Exploit for php platform in category web applications ================================================================================= . . . . | | ||/ | || | / / \ / /\ | | / | \ \ | |/ | \ / | || | // | / // | \ /\ | /|//|||| |\ | / /|| / Exploit-ID is the Indonesian Exploit Archive Web...

Multiple Buffalo routers vulnerable to cross-site request forgery

Overview Multiple routers provided by Buffalo contain a cross-site request forgery vulnerability. Multiple routers provided by Buffalo have a management screen that allows users to modify settings. These routers contain a cross-site request forgery vulnerability due to an issue in the management...

DORG 1.1 <= CSR-Forqery PoC Exploit

Exploit for php platform in category web applications DORG 1.1 Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail : submitat1337day.com 1 0 0 1 1 0 I'm KnocKout member from Inj3ct0r Team 1 1 0...

DORG 1.1 Cross Site Request Forgery

DORG 1.1 Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail : submitat1337day.com 1 0 0 1 1 0 I'm KnocKout member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 My Live...

LastPass Asks Users To Change Password After Probable Breach

ED: LastPass Asks Users To Change Password After Probable Breach DEK: The Web based password management firm says it detected what it thinks is a breach that could have exposed some customer passwords. LastPass, a Web based password management firm, advised its customers to change the password th...

CVE-2008-7289

IBM Tivoli Directory Server TDS 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service DB2 daemon deadlock by making password changes that trigger updates to a D...

CVE-2011-1721

Cross-site request forgery CSRF vulnerability in php/partieadministrateur/administration.php in WebJaxe 1.02 allows remote attackers to hijack the authentication of administrators for requests that 1 modify passwords or 2 add new projects. NOTE: some of these details are obtained from third party...

DEBIAN-CVE-2011-0285

The processchpwrequest function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 aka krb5 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service daemon crash via a crafted request that triggers a...

CVE-2011-0285

The processchpwrequest function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 aka krb5 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service daemon crash via a crafted request that triggers a...