SA-CONTRIB-2012-111 - Security Questions - Access Bypass

This module provides administrator configurable challenge questions for use during the log in and password reset processes. The module doesn't perform a proper access check, allowing a users' questions and answers to be edited by other users including anonymous users. CVE: CVE-2012-4475 Versions...

deletion of a comment with a security setting sends a notification to all watchers and the history tab

As a non-atlassian developer, I saw a deletion notification for a comment that I was restricted from viewing. That seems like a security leak. It would be annoying if we're trying to hide discussion from certain users for them to see that the discussion is happening at all, it would raise questio...

CVE-2012-1782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the 1 url bar or 2 picture bar...

Facebook Game - 21 Questions Detected (deprecated)

Binary data 6415.prm...

No Fix for Duqu Bug in November Microsoft Patches?

Microsoft plans on shipping four bulletins, of which only one is rated critical, in the November edition of Patch Tuesday. But it looks doubtful that the company will issue a fix for the vulnerability discovered this week being used by the Duqu installer. The patch is set for release on Tuesday,...

RSA Self-Service Console Detection

The remote web server hosts an RSA Self-Service Console, which is used with RSA appliances by users to reset their PINs, create security questions, etc. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid55509; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/22";...

Facebook hacker posts stolen pics on porn site !

Facebook hacker posts stolen pics on porn site ! A 26-year-old man faces 13 felony charges after being accused of hacking into Facebook accounts, stealing photos of young women and posting them on porn sites, reports the Kansas City Star. Along with content belonging to the 13 young women ages 17...

Richard Kirk hacked into more than 300 eBay users' e-mail & PayPal accounts !

Richard Kirk Kirk hacked into more than 300 eBay users' e-mail accounts after cracking their passwords. He then was able to steal money from his victims' usually secure PayPal accounts. He transferred money from PayPal into hundreds of his own accounts, and then used the stolen cash to buy valuab...

CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

Design/Logic Flaw

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

CVE-2010-3272

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified 1 HideCaptcha or 2 quesList...

CVE-2010-1910

The Forgot Password implementation in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to reset passwords of accounts with blank Hint questions and Hint answers by sending an empty value for each of these two Hint fields...

Sql injection

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728

CVE-2009-4728 affects the administrative interface of the application “Questions Answered 1.3.” The vulnerability is a SQL injection via the username parameter that could allow an attacker to execute arbitrary SQL commands on the database. Documents do not specify exact vulnerable versions beyond...

CVE-2009-4728

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-4728: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

E-Mail Security Questions Easily Answered

A Cambridge University study has shown how easy it is to guess the answer to common questions, such as someone’s mother’s maiden name. It found attackers will be able to break into 1 in 80 accounts if they get three chances to guess answers. Read the full article. BBC...

Article Friendly Local File Inclusion

======================================================================= Article friendly Insecure direct object Referece Vulnerability ======================================================================= by Pratul Agrawal Vulnerability found in- Admin module email [email protected] company...

CVE-2009-4436

Multiple SQL injection vulnerabilities in Active Web Softwares eWebquiz 8 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to 1 questions.asp, 2 importquestions.asp, and 3 quiztakers.asp, different vectors than CVE-2007-1706...