CVE-2010-3716

The beusercreation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships...

Debian DSA-2121-1 : typo3-src - several vulnerabilities

Several remote vulnerabilities have been discovered in TYPO3. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-3714 Multiple remote file disclosure vulnerabilities in the jumpUrl mechanism and the Extension Manager allowed attackers to read files wit...

OrbisCMS-1.0.2 Add Admin User CSRF

Exploit for php platform in category web applications ================================== OrbisCMS-1.0.2 CSRF Add Admin User ================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1...

Hycus CMS 1.0.1 - Multiple Cross-Site Request Forgery Vulnerabilities

Hycus CMS 1.0.1 - Multiple Cross-Site Request Forgery Vulnerabilities Date: Thu 26 Aug 2010 07:53:22 PM EEST Vendor: http://www.hycus.com/ Download: http://www.hycus.com/download/hycuscms-1.0.1.zip --- -= CSRF PoC 1 - Change Admin Password =- Hycus CMS 1.0.1 Multiple CSRF Vulnerabilities - Change...

Windows Execute net user /ADD CMD

Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars 1 UPPER, 1 lower, 1 digit/special This...

Zomplog CMS 3.9 Multiple XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications ================================================= Zomplog CMS 3.9 Multiple XSS/CSRF Vulnerabilities ================================================= Date: Sun 15 Aug 2010 04:33:33 PM EEST Vendor: http://www.zomp.nl/zomplog/ Download:...

chillyCMS 1.1.3 Cross Site Request Forgery

input type="hidden...

Macs CMS 1.1.4 Cross Site Request Forgery / Cross Site Scripting

Date: Sun 11 Jul 2010 11:53:35 AM EEST Vendor: http://macs-framework.sourceforge.net/ Download: http://sourceforge.net/projects/macs-framework/ --- -= CSRF PoC 1 - Create Admin User =- Macs CMS 1.1.4 Multiple Vulnerabilities XSS/CSRF - Create Admin User -= CSRF PoC 2 - Delete User =- -= XSS PoC =...

Elite CMS 1.01 Cross Site Request Forgery / Cross Site Scripting

Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities Author: 10n1z3d Date: Sat 10 Jul 2010 08:05:44 PM EEST Vendor: http://elitecms.net/ Download: http://elitecms.net/download.php?download=eliteCMS -= CSRF PoC 1 - Change Admin Password =- Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Chang...

TomatoCart 1.0.1 Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications ============================================== TomatoCart 1.0.1 Multiple CSRF Vulnerabilities ============================================== Date: Sun 11 Jul 2010 05:01:51 PM EEST Vendor: http://www.tomatocart.com/ Download:...

Linux/x86-64 - Add root user with password - 390 bytes

No description provided by source. / Title: Linux/x86-64 - Add root user with password - 390 bytes Date: 2010-06-20 Tested: Archlinux x8664 k2.6.33 Author: Jonathan Salwan Web: http://shell-storm.org | http://twitter.com/shellstorm ! Dtabase of shellcodes http://www.shell-storm.org/shellcode/ Add...

Apache OFBiz Multiple XSS Vulnerability

Exploit for php platform in category web applications ======================================= Apache OFBiz Multiple XSS Vulnerability ======================================= Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Apache OFBiz 1. Advisory...

Randomised password not sent in email

When creating a user with password normally, the notification email to that new user will contain the password. However creating a new user and leave the password blank, JIRA randomly generates a password for that user, but the randomised password "is not sent" in the notification email to that...

CVE-2009-4173

Cross-site request forgery CSRF vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to hijack the authentication of administrators for requests that create new users, including a new administrator, via an adduser action in the editusers module in index.php...

CuteNews 1.4.6 - index.php Cross-Site Request Forgery (New User Creation)

CuteNews 1.4.6 - index.php Cross-Site Request Forgery New User Creation source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and...

CuteNews 1.4.6 - 'index.php' Cross-Site Request Forgery (New User Creation)

source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...

XSS in header for Personal Spaces

Create a user with username "alert'hahahaha' User creates a personal space Try to add a page to the personal space This is caused by code code However since the personal space doesn't work too well with usernames with crazy letters, I don't think its a Blocker...

Kolibri+ Webserver 2 (GET Request) Remote SEH Overwrite Exploit

No description provided by source. !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+...

Kolibri+ Web Server 2 - GET Remote Overwrite (SEH)

!/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+ Webserver 2 SEH Overwrite Written by...

The use of components plus the user-to vulnerability and early warning-the black bar safety net

by:lcx Today research about the user control panel file nusrmgr. cpl, the discovery call is to the Shell. Users to add users, it also simultaneously calls the wscript. shell, Shell. Application, Shell. LocalMachine these three components. But added to the user while this one Shell. Users is...