Advanced Poll 2.0 - mysql_host Cross-Site Scripting

Advanced Poll 2.0 - mysqlhost Cross-Site Scripting source: https://www.securityfocus.com/bid/40045/info Advanced Poll is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitra...

Require user to answer CAPTCHA after three failed attempts

Require user to answer CAPTCHA after three failed attempts. For SOAP and XMLRPC this means that the user will have to open a browser to answer the CAPTCHA, similar to how google does it. This issue has been rated MODERATE. Please refer to http://confluence.atlassian.com/x/ZILmD for details on oth...

Require user to answer CAPTCHA after three failed attempts

Require user to answer CAPTCHA after three failed attempts. For SOAP and XMLRPC this means that the user will have to open a browser to answer the CAPTCHA, similar to how google does it. This issue has been rated MODERATE. Please refer to http://confluence.atlassian.com/x/ZILmD for details on oth...

Allow user accounts to require two-factor authentication using RFC 4226

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-20999. panel New feature request. In light of the recent security hack at Apache, it might be prudent for JIRA to provide some more secure...

Allow user accounts to require two-factor authentication using RFC 4226

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Cloud. Using JIRA Server? See the corresponding suggestion|http://jira.atlassian.com/browse/JRASERVER-20999. panel New feature request. In light of the recent security hack at Apache, it might be prudent for JIRA to provide some more secure...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allow remote attackers to hijack the authentication of users for requests that 1 upload image files, 2 delete image files, or 3 create blocks...

Joomla! Component Huru Helpdesk - SQL Injection (1)

Exploit Title: joomla component huruhelpdesk SQL injection Vulnerability Date: 09 april 2010 Author: bumblebe Software Link: N/A Tested on: Windows XP 2 ====================================================================== x author : bumblebe [email protected] x dork : inurl:option=comhuruhelpdes...

Kasseler CMS 1.4.x lite Module Jokes - SQL Injection

?php echo "\n\n\n"; echo " \n"; echo " Product: Kasseler CMS 1.4.x lite Module Jokes SQL-Injection Exploit \n"; echo " Usage: php.exe kasseler.php www.site.com /cmspath/ \n"; echo " Require: Magicquotes = off \n"; echo " Author: Sc0rpi0n RUS http://scorpion.su \n"; echo " Special for Antichat...

CVE-2010-1097

include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.autostart is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the SESSIONdedeadminid parameter, as demonstrated by a request to uploads/include/dialog/selectsoftpost.php...

Mini-CMS RibaFS 1.0 - Authentication Bypass

============================================================= Mini CMS RibaFS 1.0 Auth Bypass SQL Injection Vulnerability ============================================================= + Mini CMS RibaFS 1.0 Auth Bypass SQL Injection Vulnerability...

[SECURITY] Fedora 11 Update: curl-7.19.7-5.fc11

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Fedora Update for curl FEDORA-2010-2762

Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2010-2762 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

[SECURITY] Fedora 12 Update: curl-7.19.7-7.fc12

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Cmsez(with easy)the whole Station system of 0day-vulnerability warning-the black bar safety net

Program name: Cmsez Web Content Manage System v2. 0. 0 File: comments.php viewimg.php Code: --------------- ? //comments include "mainfile.php"; $art=new article; //Set $confirm='yes';//yes:need administrator authentication to the display,n is displayed directly $member=new member;...

CVE-2010-0709

Multiple cross-site request forgery CSRF vulnerabilities in Limny 2.0 allow remote attackers to 1 hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and 2 hijack the authentication of the administrator for...

Changing system locale means users with non-ASCII characters in their passwords cannot authenticate

The OSUser and Atlassian-User authenticators used by Confluence convert a password into bytes before hashing it. This conversion doesn't specify which encoding should be used, so the system's default encoding is used. If the system administrator changes the locale settings on the server or change...

CVE-2010-0633

Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API XAPI calls via unknown vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI...

CVE-2009-4572

Cross-site request forgery CSRF vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI...

MasterWeb Script <= 1.0 (details&newsID) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== MasterWeb Script = 1.0 details&newsID SQL Injection Vulnerability ==================================================================== ? Script: MasterWeb Script 1.0 ?...