9775 matches found
BlackStratus LOGStorm 4.5.1.35 / 4.5.1.96 Remote Root
!/usr/bin/python logstorm-root.py BlackStratus LOGStorm Remote Root Exploit Jeremy Brown jbrown3264/gmail Dec 2016 -Synopsis- "Better Security and Compliance for Any Size Business" BlackStratus LOGStorm has multiple vulnerabilities that allow a remote unauthenticated user, among other things, to...
Cross site request forgery (csrf)
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...
CVE-2016-9479
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...
CVE-2016-9479
The CVE-2016-9479 vulnerability affects b2evolution prior to version 6.7.9, where the lost-password feature allows a remote attacker to reset arbitrary user passwords via a crafted request. This can enable account compromise without user interaction. Root cause, as described across connected docu...
CVE-2016-9479
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...
CVE-2016-9479: Undefined Security Weakness
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...
PT-2016-7764
Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 6.7.9 Description The issue concerns the "lost password" functionality, which allows remote attackers to reset arbitrary user passwords via a crafted request. Recommendations For versions prior to 6.7.9, update to...
Drupal 8.x < 8.2.3 Multiple Vulnerabilites
Binary data 9821.prm...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9450
Removed by vendor...
CVE-2016-9450: Insufficient Verification of Data Authenticity
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
PT-2016-7761
Name of the Vulnerable Software and Affected Versions Drupal 8.x versions prior to 8.2.3 Description The issue concerns the user password reset form, which allows remote attackers to conduct cache poisoning attacks due to the failure to specify a correct cache context. Recommendations For version...
Drupal 7.x < 7.52 / 8.x < 8.2.3 Multiple Vulnerabilities
The version of Drupal running on the remote web server is 7.x prior to 7.52 or 8.x prior to 8.2.3. It is, therefore, affected by the multiple vulnerabilities : - An information disclosure vulnerability exists in the taxonomy module when using access query tags that are inconsistent with the...
Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine
The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....
SPIP 3.1 Cross Site Scripting / Header Injection
Security Advisory - Curesec Research Team 1. Introduction Affected SPIP 3.1 Product: Fixed in: 3.1.2 / 3.0.23 Fixed Version http://www.spip.net/endownload Link: Vendor Website: http://www.spip.net/ Vulnerability Reflected & Persistent XSS, Host Header Injection, httpOnly Type: Cookie disclosure...
