CVE-2015-4051

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...

MGASA-2015-0204 Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

Xeams 4.5 Build 5755 - Multiple Vulnerabilities

Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/XeamsDownload.htm Version: 4.5 Build 5755...

[CVE-2015-1583] ATutor LCMS - CSRF Vulnerability in Version 2.2

CVE-2015-1583 ATutor LCMS - CSRF Vulnerability in Version 2.2 ---------------------------------------------------------------- Product Information: Software: ATutor LCMS Tested Version: 2.2, released 25.8.2014 Vulnerability Type: Cross-Site Request Forgery, CSRF CWE-352 Download link:...

Metasploit Project < 4.11.1 - Initial User Creation CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Metasploit Project initial User Creation CSRF Google Dork: N/A Date: 14-2-2015 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.metasploit.com/ Software Link:...

Metasploit Project < 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)

Exploit Title: Metasploit Project initial User Creation CSRF Google Dork: N/A Date: 14-2-2015 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.metasploit.com/ Software Link: http://www.rapid7.com/products/metasploit/editions-and-features.jsp Version: Free/Pro...

BEdita CMS 3.5.0 - Multiple Vulnerabilities

BEdita CMS 3.5.0 - Multiple Vulnerabilities BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 &...

BEdita CMS 3.5.0 - Multiple Vulnerabilities

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 & Cross-Site Request Forgery, CSRF CWE-352...

BEdita CMS 3.5.0 XSS & CSRF Vulnerabilities

BEdita CMS version 3.5.0 suffers from cross site request forgery and cross site scripting vulnerabilities. BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0,...

BEdita CMS 3.5.0 Cross Site Request Forgery / Cross Site Scripting

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 & Cross-Site Request Forgery, CSRF CWE-352...

ATutor LCMS 2.2 Cross Site Request Forgery

CVE-2015-1583 ATutor LCMS - CSRF Vulnerability in Version 2.2 ---------------------------------------------------------------- Product Information: Software: ATutor LCMS Tested Version: 2.2, released 25.8.2014 Vulnerability Type: Cross-Site Request Forgery, CSRF CWE-352 Download link:...

GLPI 0.85.2 Shell Upload / Privilege Escalation Vulnerabilities

GLPI versions 0.85 through 0.85.2 suffer from remote shell upload and privilege escalation vulnerabilities. Multiple vulnerabilities have been identified in GLPI http://www.glpi-project.org. 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and...

GLPI 0.85.2 Shell Upload / Privilege Escalation

Multiple vulnerabilities have been identified in GLPI http://www.glpi-project.org. 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and 0.85.2 Description ======= When an user wants to create a new ticket, he has the possibility to add an...

Fat Free CRM 0.13.5 Cross Site Request Forgery Vulnerability

Fat Free CRM version 0.13.5 suffers from a cross site request forgery vulnerability. CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released...

Windows Manage PXE Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

Moderate: Red Hat Security Advisory: python-django-horizon security and bug fix update

Updated python-django-horizon packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scori...

WordPress custom-contact-forms Plugin SQL Upload

The WordPress custom-contact-forms plugin use auxiliary/admin/http/wp/customcontactforms msf undefinedcustomcontactforms show actions ...actions... msf undefinedcustomcontactforms set ACTION msf undefinedcustomcontactforms show options ...show and set options... msf undefinedcustomcontactforms ru...

TRS WCM越权直接创建任意用户（无需审核）

简要描述： 任意创建用户，无需审核，直接登录。 详细说明： 1、首先我们确定一个不存在或者密码错误的用户名： 2、通过webservice调用创建用户的方法，创建一个用户： =============================== 在乌云找了找， WooYun: TRS系统任意文件下载漏洞 中只发现一个存在该方法的案例 http://wcm.xxz.gov.cn:8080/wcm/ 湘西州政府站群 漏洞证明： 成功登录新创建的用户：...

CuteNews 1.4.6 index.php New User Creation CSRF

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...