[BMSA-2009-07] Backdoor in PyForum

BLUE MOON SECURITY ADVISORY 2009-07 =================================== :Title: Backdoor in PyForum :Severity: Critical :Reporter: Blue Moon Consulting :Products: PyForum v1.0.3 :Fixed in: -- Description ----------- pyForum is a 100 python-based message board system based in the excellent web2py...

Debian Security Advisory DSA 1924-1 (mahara)

The remote host is missing an update to mahara announced via advisory DSA 1924-1. OpenVAS Vulnerability Test $Id: deb19241.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1924-1 mahara Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

CVE-2009-3298

Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...

CVE-2009-3298

Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...

CVE-2009-3298

Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...

CVE-2009-3298

Mahara up to version 1.0.12 and 1.1.x up to 1.1.6 is affected: remote authenticated institutional administrators can reset the site administrator's password via unspecified vectors, enabling privilege escalation. Affects Mahara core components handling admin authentication. Remediation per source...

CVE-2009-3298: Undefined Security Weakness

Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors...

Default credentials

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2009-3166

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2009-3166

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

Joomla! Component AlphaUserPoints - SQL Injection

Joomla Component AlphaUserPoints SQL Injection Exploit'; echo 'jdc 2009'; echo 'Buffer'; echo 'var update = document.getElementById"update";'; iniset "memorylimit", "128M" ; iniset "maxexecutiontime", 0 ; settimelimit 0 ; if !isset $GET'url' die 'Usage: '.$SERVER'SCRIPTNAME'.'?url=www.victim.com'...

Bugzilla < 3.0.9/3.2.5/3.4.2 Multiple Vulnerabilities

Binary data 5169.prm...

CVE-2009-3180

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

Design/Logic Flaw

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

CVE-2009-3180

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

CVE-2009-3180

CVE-2009-3180 affects Anantasoft Gazelle CMS 1.0. Remote attackers can reset passwords for other users by sending a modified user parameter to renew.php; root cause appears to be improper parameter handling in renew.php. Exploitation details are not provided in the supplied documents, and no reme...

CVE-2009-3180: Undefined Security Weakness

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php...

CVE-2009-3168: Missing Authorization

Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to 1 admin/reset.php and 2 admin/useradd.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request...

PABox非授权重设用户口令漏洞

BUGTRAQ: 8067 paBox由于用户提交的输入缺少充分过滤，远程攻击者可以利用这个漏洞重设管理员的用户名和密码。 重设管理员用户名和密码就可以未授权控制应用程序。 paBox 1.6 厂商补丁： PHP Arena --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phparena.net/pabox.php...

Authentication flaw

OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update parameter set to 1 and modified user and password parameters...