CVE-2010-4535

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service resource consumption via a URL that...

PT-2011-1594

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.1.3 Django versions 1.2.x prior to 1.2.4 Django versions 1.3.x prior to 1.3 beta 1 Description The issue concerns the password reset functionality in django.contrib.auth. It does not validate the length of a string...

USN-1040-1: Django vulnerabilities

Adam Baldwin discovered that Django did not properly validate query string lookups. This could be exploited to provide an information leak to an attacker with admin privilieges. CVE-2010-4534 Paul McMillan discovered that Django did not validate the length of the token used when generating a...

Ubuntu: Security Advisory (USN-1033-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amoeba CMS v1.01 multiple remote vulnerabilities

Exploit for php platform in category web applications !/usr/bin/python """ Amoeba CMS v1.01 multiple remote vulnerabilities: Vendor: http://www.amoebacms.com/ Found by: mrme Contact date: 20/12/2010 2:37pm EST SQL Injection: ============= There is quite a few instances of pre/post auth SQL...

amoeba CMS 1.01 - Multiple Vulnerabilities

!/usr/bin/python """ Amoeba CMS v1.01 multiple remote vulnerabilities: Vendor: http://www.amoebacms.com/ Found by: mrme Contact date: 20/12/2010 2:37pm EST SQL Injection: ============= There is quite a few instances of pre/post auth SQL Injection in the web application. In one particular SQLi the...

Default credentials

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...

FreeBSD : django -- multiple vulnerabilities (14a37474-1383-11e0-8a58-00215c6a37bb)

Django project reports : Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately. Information leakage in Django administrative...

[waraxe-2010-SA#078] - Multiple Vulnerabilities in CruxCMS 3.0.0

waraxe-2010-SA078 - Multiple Vulnerabilities in CruxCMS 3.0.0 =============================================================================== Author: Janek Vind "waraxe" Date: 27. December 2010 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-78.html Affected Software: CruxCMS is a...

CruxCMS 3.0.0 Bypass / Shell Upload / SQL Injection / XSS / LFI

waraxe-2010-SA078 - Multiple Vulnerabilities in CruxCMS 3.0.0 =============================================================================== Author: Janek Vind "waraxe" Date: 27. December 2010 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-78.html Affected Software: CruxCMS is a...

CVE-2010-3905

The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users...

Authentication flaw

The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users...

CVE-2010-3905

CVE-2010-3905 affects Eucalyptus 2.0.0/2.0.1 where the password reset feature in the Admin UI does not perform authentication, allowing an unauthenticated remote attacker to gain privileges by submitting password reset requests for other users. Ubuntu advisory USN-1033-1 and related entries confi...

CVE-2010-3905: Improper Authentication

The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users...

CVE-2010-4535

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service resource consumption via a URL that...

PT-2010-5159

Name of the Vulnerable Software and Affected Versions Eucalyptus versions 2.0.0 through 2.0.1 Description The issue concerns the password reset feature in the administrator interface, which fails to perform authentication. This allows remote attackers to send password reset requests for other...

django -- multiple vulnerabilities

Django project reports: Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately. Information leakage in Django administrative...

Eucalyptus unauthorized access

Old password is not verified during password reset in administration interface...

Ubuntu 10.10 : eucalyptus vulnerability (USN-1033-1)

It was discovered that Eucalyptus did not verify password resets from the Admin UI correctly. An unauthenticated remote attacker could issue password reset requests to gain admin privileges in the Eucalyptus environment. Note that Tenable Network Security has extracted the preceding description...

USN-1033-1: Eucalyptus vulnerability

It was discovered that Eucalyptus did not verify password resets from the Admin UI correctly. An unauthenticated remote attacker could issue password reset requests to gain admin privileges in the Eucalyptus environment...