CVE-2014-6260

Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service paging outage by leveraging an unattended workstation, aka ZEN-15412...

CVE-2014-2373

The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript...

VTLS Virtua InfoStation.cgi - SQL Injection

=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...

VTLS-Virtua SQL Injection

=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...

TestLink 1.9.3 CSRF Vulnerability

No description provided by source. 下面poc会修改管理员邮箱： document.getElementById'btn'.click;...

Fortigate Firewalls - CSRF Vulnerability

No description provided by source. Vulnerability ID: CVE-2013-1414 Vulnerability Type: CSRF Cross-Site Request Forgery Product: All Fortigate Firewalls Vendor: Fortinet http://www.fortinet.com Vulnerable Version: 4.3.13 & 5.0.2 Description ========== Because many functions are not protected by...

Sitecom WLM-2501 new Multiple CSRF Vulnerabilities

No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Sitecom WLM-2501 new Multiple CSRF Vulnerabilities Date : 22-03-2012 Author : Ivano Binetti...

Server: CSRF in documents

Due to not verifying whether a request was intentionally provided by the user who submitted an request the documents application is vulnerable against several CSRF attacks. An attacker could have used this to arbitrary modify existing files or rename it. For more information please consult the...

Code injection

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors...

[USN-2013-1] MAAS vulnerabilities

========================================================================== Ubuntu Security Notice USN-2013-1 November 07, 2013 maas vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Re: [security bulletin] HPSBST02890 rev.2 - HP StoreOnce D2D Backup System, Remote Unauthorized Access and Modification

VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP StoreOnce D2D Backup System. The vulnerability could be exploited remotely resulting in unauthorized access and modification. A user who is logged in via the HPSupport user account does not have access to the dat...

Default configuration

The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE: the vendor has...

ecshop最新版本一处用户权限越权

简要描述： 用户权限越权，这位置光看代码是肯定找不到滴，需要缜密的探查和思考，我觉得我就是个侦探家～～ 详细说明： 在下订单的时候，修改收货人信息时，有个隐藏的addressid，修改这个addressid再点击“配送到这个收货地址”，便修改了addressid对应的地址实际上addressid原来对应的用户的这个地址即被删除，因为地址归属到了当前用户，遍历就能清空所有用户的收货地址了。 /includes/libtransaction.php 516行,saveconsignee方法 if $consignee'addressid' 0 / 修改地址 / $res =...

MetInfo m topology enterprise website management system 5. 0. 2 code auditing exploit and repair summary-vulnerability warning-the black bar safety net

MetInfo enterprise website management system using PHP+Mysql schema, full Station built-in SEO search engine optimization mechanism, support user since defined interface languageglobal various language, has enterprise website common of module features corporate profile module, news module, produc...

Design/Logic Flaw

The Organic Groups OG Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors...

CVE-2012-0215

CVE-2012-0215 affects the Trytond application framework prior to 2.4.0 (Python). The flaw is an improper restriction on the Many2Many field in the relation model, allowing remote authenticated users to modify privileges of arbitrary users via rpc calls: (1) create, (2) write, (3) delete, or (4) c...

[security bulletin] HPSBMU02792 SSRT100820 rev.1 - HP Business Service Management (BSM), Remote Unauthorized Disclosure of Information, Unauthorized Modification, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03377648 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03377648 Version: 1 HPSBMU02792...

[security bulletin] HPSBMU02770 SSRT100848 rev.1 - HP Insight Management Agents for Windows Server, Remote Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS), URL Redirection, Unauthorized Modification, Denial of Service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03301267 Version: 1 HPSBMU02770 SSRT100848 rev.1 - HP Insight Management Agents for Windows Server, Remote Cross Site Request Forgery CSRF, Cross Site Scripting XSS, URL Redirection, Unauthorized...

HP Insight Management Agents multiple security vulnerabilities

Cross Site Request Forgery CSRF, Cross Site Scripting XSS, URL Redirection, Unauthorized Modification, Denial of Service DoS...

HP Insight Management Agents Multiple Vulnerabilities

According to its version, the installation of HP Insight Management Agents on the remote host has multiple unspecified vulnerabilities, including cross-site scripting, cross-site request forgery, denial of service, and unauthorized modification. C Tenable Network Security, Inc. include"compat.inc...