Fat Free CRM 0.13.5 Cross Site Request Forgery Vulnerability

Fat Free CRM version 0.13.5 suffers from a cross site request forgery vulnerability. CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released...

Windows Manage PXE Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

Moderate: Red Hat Security Advisory: python-django-horizon security and bug fix update

Updated python-django-horizon packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scori...

WordPress custom-contact-forms Plugin SQL Upload

The WordPress custom-contact-forms plugin use auxiliary/admin/http/wp/customcontactforms msf undefinedcustomcontactforms show actions ...actions... msf undefinedcustomcontactforms set ACTION msf undefinedcustomcontactforms show options ...show and set options... msf undefinedcustomcontactforms ru...

TRS WCM越权直接创建任意用户（无需审核）

简要描述： 任意创建用户，无需审核，直接登录。 详细说明： 1、首先我们确定一个不存在或者密码错误的用户名： 2、通过webservice调用创建用户的方法，创建一个用户： =============================== 在乌云找了找， WooYun: TRS系统任意文件下载漏洞 中只发现一个存在该方法的案例 http://wcm.xxz.gov.cn:8080/wcm/ 湘西州政府站群 漏洞证明： 成功登录新创建的用户：...

Kolibri+ Webserver 2 - (GET Request) Remote SEH Overwrite Exploit

No description provided by source. !/usr/bin/python Could not get this to work on XP SP3. php5ts.dll is the only module with safe seh off but could not get the pop pop ret to work correctly despite the large number of usable addresses that were tested. $ ./kolibri.py 192.168.1.146 8080 Kolibri+...

CuteNews 1.4.6 index.php New User Creation CSRF

No description provided by source. source: http://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that...

eFront 3.6.14 (build 18012) - Stored XSS in Multiple Parameters

No description provided by source. Exploit-DB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage: http://www.efrontlearning.net/ vulnerable app...

PHP-Nuke Error Manager Module 2.1 error.php Multiple Variables XSS

No description provided by source. source: http://www.securityfocus.com/bid/9911/info It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors. These issu...

RoomPHPlanning <= 1.6 (userform.php) Create Admin User Exploit

No description provided by source. !/usr/bin/perl -w use LWP::UserAgent; use HTML::Form; print \n; print +=RoomPHPlanning\n; print +=v1.x\n; print +=Vul: Remote Create user with all permissions admin\n; print +=Author: Jonathan Salwan \n; print +=Web: http://www.shell-storm.org\n; print +=Mail:...

Thomson SpeedTouch 500 Series NewUser Function 31 Variable Persistent User Creation

No description provided by source. source: http://www.securityfocus.com/bid/16839/info The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. An attacker may leverage this issue to have...

Microweber CMS 0.93 - CSRF Vulnerability

No description provided by source. Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC where attacker can u...

Savant Web Server 3.1 - Remote Buffer OverflowExploit (win2003)

No description provided by source. !/usr/bin/perl D:\Documents and Settings\Administrator\Desktop\explo da uppare\provasavant.pl -h 127.0.0.1 -= Savant Web Server 3.1 Remote Buffer Overflow Exploit =- -= =- -= Coded by CorryL info:www.x0n3-h4ck.org =- + Connect to 127.0.0.1 + Using 00b7ead8 // Re...

Create a New User with UID 0 - ARM (Meta)

No description provided by source. Exploit Title: Linux/ARM - Create a new user with UID 0 MSF Date: 2010-11-25 Author: Jonathan Salwan - twitter @jonathansalwan Tested on: ARM926EJ-S rev 5 v5l Issue link: https://metasploit.com/redmine/issues/3254 This file is part of the Metasploit Framework an...

Oracle Database 10.1 MDSYS.MD2.SDO_CODE_SIZE Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13145/info Oracle Database is reported prone to a buffer overflow vulnerability. Reportedly this issue affects the 'MDSYS.MD2.SDOCODESIZE' procedure. An attacker can supply excessive data to an affected routine resulting ...

MyBulletinBoard (MyBB) < 1.1.3 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl Tue Jun 13 12:37:12 CEST 2006 [email protected] Exploit HOWTO - read this before flood my Inbox you bitch! - First you need to create the special user to do this use: ./mybibi.pl --host=http://www.example.com --dir=/mybb -1 this step needs a graph...

network tracker .95 - Stored XSS

No description provided by source. Exploit Title: Network Tracker .95 Stored XSS Date: 08-18-2011 Author: G13 Software link: http://networktracker.org/ Version: .95 ISSUE The application contains a option which allows anyone to create a user. If this option is left enabled an attacker could launc...

Domain restricted signup is creating enabled users on ApacheDS

When a user signs up to a Confluence instance that has domain restricted sign up enabled, they are normally created as disabled users and are unable to login. However, when the underlying user directory does not support disabling users, such as ApacheDS 1.5, then the user ends up being created as...

Stored XSS in OnDemand Confluence Header via username

This is from an external report. Creating a user with username: code " code and returning to the dashboard will demonstrate the script injection. This PoC will not work in Chrome/Chromium, but will in Firefox and other browsers that do not have such protective measures...

Stored XSS in OnDemand Confluence Header via username

This is from an external report. Creating a user with username: code " code and returning to the dashboard will demonstrate the script injection. This PoC will not work in Chrome/Chromium, but will in Firefox and other browsers that do not have such protective measures...