[SECURITY] Fedora 24 Update: dbus-1.11.6-1.fc24

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

CVE-2016-7143

The mauthenticate function in modules/msasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website: https://kaimi.ru CVE: CVE-2016-4340 Category:...

WordPress Plugin WP Live Chat Support Stored Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation.Live Chat Support is one of the chat plugins. WordPress plugin WP Live Chat Support has a stored cross-site scripting vulnerability that can be exploited by an attacker to log in as a WordPress user and perform...

cms.creators.com XSS vulnerability

Vulnerable URL: https://cms.creators.com/site/users/login?r= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check cms.creators.com...

careers360.com XSS vulnerability

Vulnerable URL: http://www.careers360.com/user/login?clicklocation=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3712 VIP website status:| Yes Check careers360.com SSL...

Blue Ling micro applications CMS /basic/usermanager/sysOrgUser/login fdName parameter SQL injection vulnerability

No description provided by source...

Personalization Settings, Such as Outlook Signatures, Are Not Retained

Users report that certain registry settings and personalization, such as Outlook signature settings among others, are not retained after they log off and log in again...

Nextcloud: Bruteforcing help.nextcloud.com

Hi I've found that the user is allowed to perform brute force in help.nextcloud.com login, i've tried to input wrong password 25 times , then input my correct password in my 26th attempt and it is successfully login, a malicious minded user can always continue guessing an account password. Steps ...

REST JSON - Multiple Vulnerabilities - Highly Critical - Unsupported - SA-CONTRIB-2016-033

This module enables you to expose content, users and comments via a JSON API. The module contains multiple vulnerabilities including Node access bypass Comment access bypass User enumeration Field access bypass User registration bypass Blocked user login Session name guessing Session enumeration...

caclubindia.com XSS vulnerability

Vulnerable URL: http://www.caclubindia.com/userlogin.asp?redirect=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6845 VIP website status:| Yes Check caclubindia.com SSL...

The vulnerability of the Cacti network monitoring software allows a hacker to circumvent existing access restrictions.

The vulnerability of the Cacti network monitoring software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions by logging in as a user who is not registered in the database...

KPPW v2.6 /api/uc.php SQL注入漏洞与任意用户登录漏洞

No description provided by source...

New Relic: open redirection at login

Hi guys, their is open redirection at login page if the user logged in he will be redirected directly if the user not logged in he will be redirected after the login URL : https://login.newrelic.com/login?returnto=http:example.com to reproduce go to...

Servision HVG Hardcoded Credentials

Hello... Over a year ago I disclosed several vulnerabilities in Servision HVG network video recording devices. CVE-2015-0929 and CVE-2015-0930. https://www.kb.cert.org/vuls/id/522460 Since it's been a while now, and hardcoded backdoor passwords in "security" devices are the current hotness...

espcms最新版V6.4.15.08.25任意用户登录漏洞

No description provided by source...

U-Mail V9.8.57 /fast/default/operates.php 任意用户登录及注入漏洞

No description provided by source...

ThinkSNS v3 /apps/page/Lib/Action/DiyAction.class.php 任意用户登陆+后台管理绕过

No description provided by source...

Change Password Option Not Working for Users Connecting to StoreFront

Users are able to log into StoreFront 2.5 successfully, but are unable to change passwords. Once a user clicks the change password menu option, they get error:Cannot complete your request. The user is then presented with a logon button. Event logs do not indicate issue. The StoreFront 2.5...

MGASA-2015-0486 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: In MediaWiki before 1.23.12, an XSS vector exists when MediaWiki is configured with a non-standard configuration, from wikitext when $wgArticlePath='$1' CVE-2015-8622. In MediaWiki before 1.23.12, tokens were being compared as strings, whic...