openssh: ~/.k5users unexpectedly grants remote login

It was found that when OpenSSH was used in a Kerberos environment, remote authenticated users were allowed to log in as a different user if they were listed in the /.k5users file of that user, potentially bypassing intended authentication restrictions...

ownCloud Server Authentication Vulnerability

ownCloud is a free and open source personal cloud storage solution created by German KDE developer Frank Karlitschek. The solution offers file management, music storage, calendars, and more. A security vulnerability exists in ownCloud Server due to the FTP backend "userexternal" failing to provid...

VDG Security SENSE Design Vulnerability

VDG Security SENSE is a video management system VMS from VDG Security in the Netherlands. VDG Security SENSE formerly DIVA version 2.3.13 performs authentication using a password hash instead of a password, allowing a remote attacker to gain login privileges by exploiting knowledge of the passwor...

CVE-2014-9278

The OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment, allows remote authenticated users to log in as another user when they are listed in the .k5users file of that user, which might bypass intended authentication requirements that would...

CVE-2014-9006

Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the loginattempts cookie or setting it to certain values...

D-Link DAP-1360 Abuse / Cross Site Request Forgery

Hello list! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This mod...

Buffalo NAS Login Utility

This module simply attempts to login to a Buffalo NAS instance using a specific username and password. It has been confirmed to work on version 1.68 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

XSS and CSRF vulnerabilities in Zyxel P660RT2 EE

Hello 3APA3A! These are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with...

CVE-2014-3332

Cisco Unified Communications Manager CM 8.6.2 and earlier has an incorrect CLI restrictions setting, which allows remote authenticated users to establish undetected concurrent logins via unspecified vectors, aka Bug ID CSCup98029...

RoseOnlineCMS <= 3 B1 Remote Login Bypass Exploit

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | RoseOnlineCMS = 3 B1 Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Download...

paFileDB 3.5.2/3.5.3 - Remote Login Bypass SQL Injection Vulnerability

No description provided by source. PafileDB Login SQL injection = author : koray & [email protected] Risk : High Class : Remote Vulnerable Script : pafileDB Version : 3.5.2 / 3.5.3 google : powered by pafiledb 3.5.3/2 greetz : www.cigicigi.net & redhackers Vulnerable; include/admin/auth.php c0de...

HR Assist <= 1.05 (vdateUsr.asp) Remote Login ByPass Vulnerability

No description provided by source. Title : HR Assist = 1.05 vdateUsr.asp Remote Login ByPass SQL Injection Author : ajann Page : http://www.ezhrs.com Contact : : $$$ : $45 Example: http://target/path/ UserName: ' union select 0,0,0,0,0,0,0,0,0,0,0,0,0 from admin ajann,Turkey ... Im not Hacker!...

Maxum Rumpus FTP Server 1.3.2/1.3.4/2.0.3 dev Remote DoS

No description provided by source. source: http://www.securityfocus.com/bid/2716/info Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections. It is possible to log in remotely to the server and shut down the service by making a directory with a name...

Q-Shop 3.0 - Remote XSS/SQL Injection Vulnerabilities

No description provided by source. 000000 00000 0000 0000 000 00 000000 0000000 0000 000000 00000 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00000 0 0 0 0 0 0 0 0 00000 0000 0 0 0 0 00000 0 0 0 0 0 0 0 0 0 0 000 0 0 0 ...

MoME CMS <= 0.8.5 - Remote Login Bypass Exploit

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | MoME CMS = 0.8.5 Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Download:...

SSH2 3.0 Short Password Login Vulnerability

source: http://www.securityfocus.com/bid/3078/info An input validation error exists in version 3.0.0 of the SSH daemon sshd running on Unix platforms. It may be possible for remote users to log in to accounts for which there are two or less characters in the password field of the system password...

TR News <= 2.1 (login.php) Remote Login Bypass Exploit

No description provided by source. ?php errorreporting0; / ------------------------------------------------------ TR News = 2.1 login.php Remote Login ByPass Exploit ------------------------------------------------------ By StAkeRathotmaildotit http://www.easy-script.com/scripts-dl/trscript-21.zi...

2532/Gigs 1.2.2 - Stable Remote Login Bypass Vulnerability

No description provided by source. / ------------------------------------------------------------------------------------------------ 2532|Gigs 1.2.2 Stable Remote Login Bypass Vulnerability ------------------------------------------------------------------------------------------------ by athos ...

SGI IRIX 5.3/6.2,SGI license_oeo 1.0 LicenseManager NETLS_LICENSE_FILE Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/72/info Under normal operation LicenseManager1M is a program used to view and manage FLEXlm and NetLS software licenses. Unfortunately, a set of vulnerabilities has been discovered that allows LicenseManager1M to overwrit...

al3jeb script Remote Login Bypass Exploit

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | al3jeb script Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Date: 19.01.201...