Vtiger CRM < 6.5.0 Multiple Vulnerabilities

Vtiger CRM is prone to a privilege escalation and unrestricted file upload vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-4834

VTiger CRM (version 6.4.0 and earlier) is affected by CVE-2016-4834 due to insufficient access control in modules/Users/actions/Save.php, allowing remote authenticated users to create or modify user accounts. The OpenVAS entry corroborates privilege escalation and unrestricted file upload vectors...

Moodle 2.0.x < 2.0.8 / 2.1.x < 2.1.5 / 2.2.x < 2.2.2 Multiple Vulnerabilities

Binary data 9401.prm...

Wowza Streaming Engine 4.5.0 Cleartext Sensitive Information Storage

i? Wowza Streaming Engine 4.5.0 Cleartext Storage Of Sensitive Information Vendor: Wowza Media Systems, LLC. Product web page: https://www.wowza.com Affected version: 4.5.0 build 18676 Summary: Wowza Streaming Engine is robust, customizable, and scalable server software that powers reliable video...

Insecure Unserialize in TYPO3 Import/Export

It has been discovered, that TYPO3 is susceptible to Insecure Unserialize. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Import/Export Vulnerability Type: Insecure Unserialize Affected Versions: Versions 6.2.0 to 6.2.25, 7.6.0 to 7.6.9 and 8.0.0 to 8.2.0 Severity:...

The vulnerability of the Simatic WinCC software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability exists in the implementation of the Web Navigator interface in Siemens WinCC, due to the presence of a strictly encrypted user account. Exploiting this vulnerability allows malicious individuals operating remotely to gain access to the system through a specially crafted request...

██████: Cross-site request forgery vulnerability resulting in the deletion of a user's account.

One of the first cross-site request forgery vulnerabilities that I discovered on █████ allowed me to delete an unsuspecting user's account. In order to exploit this issue, I crafted a simple HTML form that sent a POST request to the /unregister endpoint when a user loaded the malicious page. html...

CodoForum 3.4 - Persistent Cross-Site Scripting

Exploit Title: Codoforum v3.4 Stored Cross-Site Scripting Stored XSS Google Dork: intext:"powered by codoforum" Date: 01/06/2016 Exploit Author: Ahmed Sherif OffensiveBits Vendor Homepage: http://codologic.com/page/ Software Link: http://codoforum.com/index.php Version: V3.4 Tested on: Linux Mint...

FantasyTote: Session doesn't expired after login

Hi, I don't know is it a valid vulnerability under your program but I found it. Attacker can use victims cookie to logged in user account again. Steps ===== 1 Login as user 2 Copy cookie you may use http://www.editthiscookie.com addon to edit cookies. 3 Logged out and delete cookie. 4 Now as a...

Liferay Portal User Account Stored Cross Site Scripting (CVE-2016-3670)

A persistent XSS vulnerability exists in the user account creation process in Liferay Portal. The vulnerability is due to insufficient input validation of the firstName, middleName and lastName parameters. Successful exploitation could allow the attacker to inject arbitrary script code into a use...

Npcap - the Nmap Project's packet sniffing library for Windows

Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter LWF technique. It supports Windows Vista, 7, 8 and 10 . It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and 2015 . It also received many helpful tests from Wireshark and NetScanTools...

Cisco WebEx Meeting Center User Account Enumeration Vulnerability

Cisco WebEx Meeting Center is a set of WebEx meeting solutions in the United States Cisco Cisco company's network of online meeting products. The product invites others to join the meeting via e-mail or instant messaging IM, and supports online product demonstrations, information sharing, and mor...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

Authentication flaw

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

The pamsmauthenticate function in pamsshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account...

CVE-2016-4422

Removed by vendor...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

Dropbox Acquisitions: Session hacking

I hereby want to report a vulnerability i.e. Session hacking. Summary ======== Attacker can still do activities in browser with user's account if user changed his/her password in another browser. Detail ===== If user logged in account in two or more browsers and he has changed password in one of...