D-Link DVG­N5402SP - Multiple Vulnerabilities

Exploit Title: DLink DVG­N5402SP Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.dlink.com/ Versions Reported: Multiple - See below CVE-IDs: CVE-2015-7245 + CVE-2015-7246 + CVE-2015-7247 DLink DVG­N5402SP File Path Traversal, Weak Credentials Management, and Sensitive...

Data on 5 Million Users Compromised in Breach at Toy Maker VTech

UPDATE VTech, a company that manufactures electronic learning devices, baby monitors, toys, and other equipment, announced Monday that information from five million customer accounts, which include identity information belonging to children, were accessed in an attack earlier this month. The news...

WordPress Users Ultra Plugin 1.5.50 - Unrestricted File Upload

Because of this vulnerability, there is no sanitization for values in CSV file this file is accessible by anyone, all additional columns are in this file. In this way, an attacker can create and activate user accounts and compromise the whole site. Solution Upgrade the plugin...

WordPress Users Ultra 1.5.50 Unrestricted File Upload

Exploit Title: WordPress Users Ultra Plugin Unrestricted File Upload Discovery Date: 2015/10/27 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link:...

CVE-2007-2243

OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483...

CVE-2015-7685

GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the profilesid parameter to front/user.form.php...

Chamilo LMS 1.9.10 /main/calendar/agenda_list.php 跨站脚本漏洞

I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform...

Bugzilla < 4.2.15 / 4.4.10 / 5.0.1 Unauthorized Account Creation Vulnerability

According to its banner, the version of Bugzilla running on the remote host contains a flaw that causes input passed via the 'login' parameter to be truncated, resulting in domain names of email addresses becoming corrupted. An unauthenticated, remote attacker can exploit this to create accounts...

Endian Firewall - Password Change Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall Proxy Password Change Command Injection', 'Description' = %q This module exploits an OS command injection...

Shopify Bug Bounty #8 - (FilePath) Cross Site Vulnerability

Document Title: =============== Shopify Bug Bounty 8 - FilePath Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1592 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ====================================...

Page2Flip 2.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Missing Function Level Access Control...

PHPfileNavigator v2.3.3 CSRF Add Arbitrary Users

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

Moderate: Red Hat Security Advisory: pam security update

An updated pam package that fixes one security issue is now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

PHPfileNavigator 2.3.3 - Cross-Site Request Forgery

PHPfileNavigator 2.3.3 - Cross-Site Request Forgery + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product:...

PHPfileNavigator 2.3.3 - Cross-Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

VirtueMart component authentication bypass vulnerability in Joomla!

Joomla! is an open source Content Management System CMS that provides RSS feeds, site search, etc. VirtueMart is one of the e-commerce components. An authentication bypass vulnerability exists in Joomla! VirtueMart that allows remote attackers to bypass restrictions and take control of user...

PHPfileNavigator 2.3.3 Cross Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

[SECURITY] Fedora 21 Update: libuser-0.62-1.fc21

The libuser library implements a standardized interface for manipulating and administering user and group accounts. The library uses pluggable back-ends to interface to its data sources. Sample applications modeled after those included with the shadow password suite are included...

RedHat Update for libuser RHSA-2015:1483-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...