fims File Management System 1.2.1a - Multiple Vulnerabilities

Exploit Title: fims - File Management System execute"select from fimsuser where email='$email' and password=md5'$password'"; if $db-numrows$rs0 return true; else return false; Line 51 of index.php: if isset$REQUESTf assertisnumeric$REQUESTf; $file = getfiledata$gdb, $REQUESTf; header"Accept-Range...

User authentication failed

When adding an ESX server to Veeam Backup and Replication console and specifying SSH Connection Settings the error message pops up: "Failed to login to "servername" by SSH, port 22, user "user", elevateToRoot False, autoSudo False User authentication failed...

Allomani Songs & Clips 2.x (msg_id) Blind SQL Injection Exploit

Exploit for php platform in category web applications ?php / =============================================================== Allomani Songs & Clips 2.x msgid Blind SQL Injection Exploit =============================================================== +Version : 2.x +Author : ahwak2000 +home :...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Spacewalk Java site packages aka spacewalk-java 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests...

Microsoft Telnet and WinHTTP Multiple Services Denial of Service

Multiple Denial of Service DoS vulnerabilities have been reported in Microsoft Windows Telnet and WinHTTP. Remote attackers can trigger these vulnerabilities by sending specially crafted malicious requests to the affected services. The vulnerabilities are due to a design flaw in Microsoft Telnet'...

Session hacking via authentication cookie on Oracle CRM on Demand

Vulnerability Title: Session hacking via authentication cookie on Oracle CRM on Demand Date: 20/05/2011 Vendor: Oracle Product: Oracle CRM on Demand Software Link: https://sso.crmondemand.com/ Summary: Oracle CRM on Demand is a web application to manage Customer information. Desc: On login proces...

IBM solidDB User Authentication Bypass Vulnerability

IBM solidDB is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ibm:soliddb";...

Moderate: Red Hat Security Advisory: Red Hat Network Satellite Server security update

Updated packages that fix two security issues are now available for Red Hat Network Satellite Server 5.4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to 1 adding a saved search in buglist.cgi, 2 voting in...

Vanilla Forums 2.0.16 Cross Site Scripting

============================================================================== Vanilla Forums 2.0.16 = Cross Site Scripting Vulnerability ============================================================================== 1. OVERVIEW The Vanilla Forums 2.0.16 and lower versions were vulnerable to Cros...

Facebook Used Social Authentication To Shield Tunisian Protesters

Faced with the Tunisian government’s efforts to hack the Facebook accounts of protesters, Facebook’s security team stepped up its use of social authentication to help secure protester’s accounts. A new account of the role of the Facebook in aiding widespread protests against the regime in Tunisia...

B-Cumulus - tagcloud Multiple Cross-Site Scripting Vulnerabilities

B-Cumulus - tagcloud Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/45911/info B-Cumulus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

SSH password weakness

Added: 01/05/2011 CVE: CVE-1999-0502 Background Passwords are the most commonly used method of authenticating users to a server. The combination of a login name and password is used to verify the identity of a user requesting access, and to determine what parts of the server the user has permissi...

Sahana Agasti 0.6.4 SQL Injection

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ posdubatgmail.com Sahana Agasti Connect$conf'dbhost'.$conf'dbport'?':'.$conf'dbport':'',$conf'dbuser',$conf'dbpass',$conf'dbname'; $level=$GET"sel...

Fine fast CMS news content management system vulnerability-vulnerability warning-the black bar safety net

Author: mind original: http://t00ls.net/thread-14046-1-1.html First of all I'm just a rookie, even the PHP basic syntax is also not too understand. The following is my personal analysis of the results, as there are errors, please forgive me. The main problem in retrieve password: member. php?...

RHEL 6 : mod_auth_mysql (RHSA-2010:1002)

An updated modauthmysql package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Citrix Access Gateway - Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Citrix Access Gateway Command Injection Vulnerability Release Date: 2010-12-21 Application: Citrix Access...

Citrix Access Gateway Command Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Citrix Access Gateway Command Injection Vulnerability Release Date: 2010-12-21 Application: Citrix Access...

SSL Certificate Cannot Be Trusted

The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below : - First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can...

Microsoft Windows Netlogon RPC Null dereference Denial of Service (MS10-101; CVE-2010-2742)

The Netlogon Remote Protocol is a remote procedure call RPC interface that is used for user and machine authentication on domain-based networks. A remote denial of service vulnerability has been discovered in implementations of the Netlogon RPC Service on affected versions of Windows Server. The...