301 matches found
CVE-2016-0710
CVE-2016-0710 affects Apache Jetspeed’s User Manager SQL injection vulnerability. The issue allows remote attackers to manipulate the back-end database by injecting SQL through the (1) role or (2) user parameter to services/usermanager/users/, before Jetspeed 2.3.1. Public references in the conne...
CVE-2016-2171
CVE-2016-2171 affects Apache Jetspeed prior to 2.3.1, where the User Manager REST API fails to properly restrict access via Jetspeed Security. This allows a remote attacker to perform add, edit, or delete operations on users through the REST API. The IBM advisory consolidates multiple Jetspeed vu...
Apache Jetspeed Arbitrary File Upload
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecured User Manager REST API and a ZIP file path traversal ...
Apache Jetspeed - Arbitrary File Upload (Metasploit)
Exploit for java platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecure...
Apache Jetspeed - Arbitrary File Upload (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecured User Manager REST API and a ZIP file path traversal ...
Apache Jetspeed User Manager Service SQLi
The Apache Jetspeed application running on the remote host is affected by a SQL injection vulnerability in the User Manager service due to improper sanitization of user-supplied input to the 'user' and 'role' parameters. An unauthenticated, remote attacker can exploit this to inject SQL queries,...
Apache Jetspeed Arbitrary File Upload
This module exploits the unsecured User Manager REST API and a ZIP file path traversal in Apache Jetspeed-2, version 2.3.0 and unknown earlier versions, to upload and execute a shell. Note: this exploit will create, use, and then delete a new admin user. Warning: in testing, exploiting the file...
WordPress Cimy User Manager Plugin <= 1.4.2 - Arbitrary File Disclosure
This plugin is prone to "cimyumfilename" arbitrary file disclosure vulnerability. It allows attackers to disclose certain sensitive information. Solution Update plugin...
DokuWiki persistent Cross Site Scripting
Advisory ID: SGMA15-001 Title: DokuWiki persistent Cross Site Scripting Product: DokuWiki Version: 2014-09-29c and probably prior Vendor: www.dokuwiki.org Vulnerability type: Persistent XSS Risk level: Medium Credit: Filippo Cavallarin - segment.technology CVE: N/A Vendor notification: 2015-03-18...
MGASA-2015-0118 Updated dokuwiki package fixes security vulnerability
DokuWiki before 20140929d is vulnerable to a cross-site scripting XSS issue in the user manager. The user's details were not properly escaped in the user manager's edit form. This allows a registered user to edit her own name using the change profile option to include malicious JavaScript code. T...
Updated dokuwiki package fixes security vulnerability
DokuWiki before 20140929d is vulnerable to a cross-site scripting XSS issue in the user manager. The user's details were not properly escaped in the user manager's edit form. This allows a registered user to edit her own name using the change profile option to include malicious JavaScript code. T...
[SECURITY] Fedora 20 Update: kdeadmin-4.14.1-1.fc20
The kdeadmin metapackage includes administrative tools including: kcron: systemsettings module for the cron task scheduler ksystemlog: system log viewer kuser: user manager...
Cimy User Manager <= 1.4.2 - Arbitrary File Disclosure
The Cimy User Manager WordPress plugin was affected by an Arbitrary File Disclosure security vulnerability...
NetIQ Privileged User Manager 2.3.1 ldapagnt_eval() Remote Perl Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require...
Novell NetIQ Privileged User Manager 2.3.1 ldapagnt.dll ldapagnt_eval() Perl Code Evaluation RCE
No description provided by source. Novell NetIQ Privileged User Manager 2.3.1 ldapagnt.dll ldapagnteval Perl Code Evaluation RCE pre auth/SYSTEM Tested against: Microsoft Windows 2003 r2 sp2 download url: http://download.novell.com/index.jsp search Privileged User Manager file tested:...
Novell NetIQ Privileged User Manager 2.3.1 auth.dll pa_modify_accounts() RCE
No description provided by source. Novell NetIQ Privileged User Manager 2.3.1 auth.dll pamodifyaccounts Remote Code Execution pre auth / SYSTEM privileges Tested against: Microsoft Windows 2003 r2 sp2 download url: http://download.novell.com/index.jsp search Privileged User Manager file tested:...
Microsoft Systems Management Server 2.0 Default Permissions Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/945/info The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable will run with System privileges...
CSP MySQL User Manager 2.3 SQLi Vulnerability
CSP MySQL User Manager is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
