e107 CMS 2.1.2 - Privilege Escalation

e107 CMS 2.1.2 - Privilege Escalation Exploit Title: e107 CMS 2.1.2 Privilege Escalation Date: 09-11-2016 Software Link: http://e107.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Datas from...

CVE-2016-7442

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

CVE-2016-7397

The CVE-2016-7397 vulnerability affects the Sophos UTM Frontend component (firmware 9.405-5 and earlier). A local administrator can disclose sensitive password information by reading the value field of the SMTP user settings in the Notifications configuration tab. Public disclosures and multiple ...

ISPConfig 3.0.5 Cross Site Request Forgery

!-- tanks: Dr Ms Jk - n1arash - Milad Hacking - malahsky...

Clicky by Yoast <= 1.5 - Minor Security Improvements

From the changelog: - Only allow expected characters in user settings thanks to a report by Netsparker. - Proper escaping of translated string in image attributes...

MGASA-2015-0463 Updated python-django packages fix security vulnerability

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format CVE-2015-8213...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

Cross site request forgery (csrf)

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

CVE-2015-5640 relates to baserCMS prior to 3.0.8. Multiple connected sources confirm a vulnerability where a logged-in, authenticated user can modify arbitrary user settings by sending a specially crafted request, effectively an access-control bypass. The impact described across advisories is tha...

Design/Logic Flaw

Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to...

Metasploit Project 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)

Metasploit Project 4.11.1 - Initial User Creation Cross-Site Request Forgery Metasploit Exploit Title: Metasploit Project initial User Creation CSRF Google Dork: N/A Date: 14-2-2015 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.metasploit.com/ Software Link:...

CVE-2015-1057

Cross-site scripting XSS vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value...

e107 2 Bootstrap CMS - XSS Vulnerability

Exploit for php platform in category web applications | | | || / | |/' | | || | / / | /| \ / /\ | / / \ |/ / alertString.fromCharCode88, 83, 83 or "alertdocument.cookie ======== Credits: ======== Vulnerability found and advisory written by Ahmet Agar. =========== References: ===========...

Updated kdebase4-workspace packages fix security vulnerability and various bugs

This update fixes a security vulnerability in the KDE workspace configuration module for setting the date and time CVE-2014-8651, mga14487, and fixes some additional issues: - fix kcm botching unrelated user settings mga3310, bko254430, - do not popup during initialization 0 B Removable media...

MGASA-2014-0445 Updated kdebase4-workspace packages fix security vulnerability and various bugs

This update fixes a security vulnerability in the KDE workspace configuration module for setting the date and time CVE-2014-8651, mga14487, and fixes some additional issues: - fix kcm botching unrelated user settings mga3310, bko254430, - do not popup during initialization 0 B Removable media...

Chipmunk Board Script 1.x - Multiple CSRF Vulnerabilities

No description provided by source. ------------------------------------------------------------------------------------------------- Title: Chipmunk Board Script 1.x Multiple XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.comhttp://gmail.com Date: 11. December 2009...

e107 <= 0.7.15 - (extended_user_fields) Blind SQL Injection Exploit

No description provided by source. !/usr/bin/env perl e107 = 0.7.15 extendeduserfields Blind SQL Injection Exploit Description ------------------------------------------------------------------- e107 contains one flaw that allows an attacker to carry out an SQL injection attack. The issue is due ...

Localize: Change user settings through CSRF

Hello, it's trivial to change the user settings. Just use this HTML code: In addition with some Javascript code that submits the form automatically, making the user visit the snipped of code above will change their user settings. If their e-mail address is altered too, and the adversary gets a...

UBUNTU-CVE-2013-4342

xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service...