Design/Logic Flaw

Google Chrome before 39.0.2171.65 on Android does not prevent navigation to a URL in cases where an intent for the URL lacks CATEGORYBROWSABLE, which allows remote attackers to bypass intended access restrictions via a crafted web site...

WordPress 2.9 - Failure to Restrict URL Access

...

WordPress 2.9 - Failure to Restrict URL Access

Description When WordPress implemented the new Trash feature they failed to change the permissions granted when the post is in the trash. This means that an unauthenticated user cannot see the post, however an authenticated user can, no matter what privileges they have, even ‘subscriber’. See...

CVE-2014-1369

WebKit in Apple Safari before 6.1.5 and 7.x before 7.0.5 allows user-assisted remote attackers to access file: URLs by leveraging a URL drag operation that originates at a crafted web site...

eLineStudio Site Composer (ESC) <= 2.6 - Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: eLineStudio Site Composer ESC =2.6 Multiple Vulnerabilities Vendor: www.elinestudio.com Vulnerable Version: 2.6 and prior versions Exploit: Available Impact: High Fix: N/A Original Advisory:...

quickersite 1.8.5 - Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: QuickerSite Multiple Vulnerabilities Vendor: www.quickersite.com Vulnerable Version: 1.8.5 Exploit: Available Impact: High Fix: N/A Original Advisory: http://bugreport.ir/index.php?/39 1. Description:...

WordPress 2.9 - Failure to Restrict URL Access

No description provided by source. WordPress = 2.9 Failure to Restrict URL Access http://www.thomasmackenzie.co.uk/ 1. Advisory Information Title: WordPress = 2.9 Failure to Restrict URL Access Date published: 2. Vulnerability Information Class: Failure to Restrict URL Access Remotely Exploitable...

OneFileCMS - Failure to Restrict URL Access

No description provided by source. Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested on:...

Yahoo!: Information Disclosure, groups.yahoo.com,6-april-2014, #SpringClean

Thank you for your submission to Yahoo’s Bug Bounty program. While we recognize the effort that you put into the research and writing of a report for us to evaluate, but unfortunately this bug is already known to us. We appreciate your adherence to responsible disclosure guidelines and look forwa...

SA-CONTRIB-2013-073 - Make Meeting Scheduler - Access Bypass

This module enables you to create polls accessible by an url with hash e.g. example.com/makemeeting/sn9028xh3398 so that anonymous users can view and vote on the poll. The module didn't sufficiently check access when a poll is accessed directly via its node url e.g. node/123. Note: a user with th...

[Full-disclosure] Magnolia CMS multiple access control vulnerabilities

Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ====== CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...

chillyCMS 1.3.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Vulnerability Failure to Restrict URL Access chillyCMS uses 302 redirects to restrict access to the unautorized pages. Exploit Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/ Step 2: Access...

ChillyCMS 1.3.0 - Multiple Vulnerabilities

Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: "powered by chillyCMS" Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMSfull.zip Version: 1.3.0...

OneFileCMS - Failure to Restrict URL Access

OneFileCMS - Failure to Restrict URL Access Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested...

OneFileCMS - Failure to Restrict URL Access

Exploit Title: OneFileCMS - Failure to Restrict URL Access Date: 12th March 2012 Author: Abhi M Balakrishnan Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php Version: upto 1.1.4 Tested on: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9,...

OneFileCMS - Failure to Restrict URL Access

Exploit for php platform in category web applications Exploit Title: OneFileCMS - Failure to Restrict URL Access | Date: 12th March 2012 | Author: Abhi M Balakrishnan | Software Link: https://github.com/rocktronica/OneFileCMS/blob/4340be5355b702c771ef03d4b00c74d358443b38/onefilecms.php | Version:...

SMF 2.0 RC5 Shell Upload

Title : SMF 2.0 RC5 Remote Shell Upload Exploit Author : KedAns-Dz E-mail : [email protected] Home : HMD/AM 30008/04300 - Algeria -00213555248701 Twitter page : twitter.com/kedans platform : php Impact : Remote Shell Upload Tested on : Windows XP sp3 FR » In The name of Allah Go0Gle D0rk : "Power...

[shopex.cn] - 1 处源代码下载、泄漏敏感信息漏洞

简要描述： 可通过 URL 直接下载或查看 Web 程序目录结构、源代码、 Subversion 服务器地址、有权限修改程序的账号等信息。 详细说明： 可通过 URL 直接下载或查看 Web 程序目录结构、源代码、 Subversion 服务器地址、有权限修改程序的账号等信息。 漏洞证明： http://book.shopex.cn/.svn/entries By:Any...

WordPress 2.9 URL Access Bypass

WordPress = 2.9 Failure to Restrict URL Access http://www.thomasmackenzie.co.uk/ 1. Advisory Information Title: WordPress = 2.9 Failure to Restrict URL Access Date published: 2. Vulnerability Information Class: Failure to Restrict URL Access Remotely Exploitable: Yes Locally Exploitable: Yes 3...

WordPress >= 2.9 Failure to Restrict URL Access

Exploit for unknown platform in category web applications =============================================== WordPress = 2.9 Failure to Restrict URL Access =============================================== WordPress = 2.9 Failure to Restrict URL Access http://www.thomasmackenzie.co.uk/ 1. Advisory...