CVE-2014-9247

CVE-2014-9247 affects Zenoss Core up to 5 Beta 3, where remote authenticated users can enumerate sensitive data (user accounts, e-mail addresses, and roles) via the ZenUsers (User Manager) page. Root cause details are not provided in the initial description, and exploitation status or patch infor...

CVE-2014-9247

Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive 1 user account, 2 e-mail address, and 3 role information by visiting the ZenUsers aka User Manager page, aka ZEN-15389...

KPPW最新版SQL注入漏洞三(SQL注入及越权操作各两处）

简要描述： KPPW最新版SQL注入漏洞三SQL注入及越权操作各两处），附脚本 详细说明： KPPW最新版SQL注入漏洞三SQL注入及越权操作各两处），附脚本 第一处SQL注入 文件/control/user/accountbasic.php: if$intUserRole === 2 ...... else $intAuthStatus = kekeauthfacclass::authcheck "realname", $gUid ; if isset$formhash&&kekezu::submitcheck$formhash if...

WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities

According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery...

Microsoft Releases Emergency Out-of-Band Patch for Kerberos Bug MS14-068

Microsoft today released an "out-of-band" security updates to fix a critical vulnerability in all supported versions of its Windows Server software that cyber criminals are exploiting to compromise whole networks of computers. The Emergency patch release comes just one week after Microsoft provid...

RHEL 6 : rhevm-reports 3.3.3 (RHSA-2014:0558)

An updated rhevm-reports package that fixes three security issues and one bug is now available. The Red Hat Security Response Team has rated this update as having Low security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...

Microsoft PowerPoint Vulnerable to Zero-Day Attack

It seems that there is no end to the Windows zero-days, as recently Microsoft patched three zero-day vulnerabilities in Windows which were actively exploited in the wild by hackers, and now a new Zero-day vulnerability has been disclosed affecting all supported releases of Windows operating syste...

Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability

Document Title: =============== Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1222 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID: ====================================...

Bugzilla Vulnerability Exposes Bug Collections

Hundreds of open source software projects that make use of Bugzilla, Mozilla’s bug-tracking software, anxiously await a patch for a vulnerability that exposes private bugs collected by the system. Mozilla is today expected to make available a patch for the vulnerability in its account creation...

CVE-2012-5497

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

Code injection

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

PYSEC-2014-39

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

Wechat exposed two vulnerabilities: not authorized to login others account-vulnerability warning-the black bar safety net

Recently the black bar safety net vulnerability announcements section of the public Tencent wechat are two of the vulnerabilities. According to the vulnerability of the author described by the two vulnerability a hacker may not be authorized to access and log in directly to their wechat account...

M/Monit 3.3.2 - Cross-Site Request Forgery

Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: CSRF PoC for M/monit input type="submit" name="subm...

CVE-2014-5377

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

Server side request forgery (ssrf)

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

CVE-2014-5377

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...

HackerOne: Notification of previous signed out user leakage.

This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security. Steps to reproduce 1. I logged on to hackerone with my team @movielee id.I saw that there were 6 notifications pending.I didnot checked those and logged out. 2. I logged in...

YiDacms 最新版重置任意用户账户二及其他越权操作

简要描述： YiDacms 最新版重置任意用户账户，及其他越权操作 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 之前发过一次重置任意用户密码的漏洞，但是只能修改成固定的密码，要是修改成任意密码的话，比较麻烦，需要md5明文密码后取10位作为信息密码，较麻烦。 这里我们直接输入任意明文密码，即可修改 来看看源代码： 文件/Yidacms/user/user.asp if request"yidacms"="password" Then set rs=server.createobject"adodb.recordset" useri...