Symantec Messaging Gateway Save.do Cross Site Request Forgery - Improved Performance (CVE-2012-0308)

A cross-site request forgery CSRF vulnerability has been reported in Symantec Messaging Gateway. The vulnerability is due to errors while validating user input. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted URI. Successful exploitation would allow...

PHPBoost 4.0 <= (FileUpload/Disclosure) Multiple Vulnerabilities

PHPBoost 4.0 Multiple Vulnerabilities - Remote File Upload - Full Informations Disclosure 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; 2 create a user or...

CVE-2012-6508: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; 2 create a user or...

MySQL (Linux) - Database Privilege Escalation

use DBI; $|=1; =for comment MySQL privilege elevation Exploit This exploit adds a new admin user. By Kingcope Tested on Debian Lenny mysql-5.0.51a OpenSuSE 11.4 5.1.53-log How it works: This exploit makes use of several things: The attacker is in possession of a mysql user with 'file' privileges...

SAP /sap/bc/soap/rfc SOAP Service SUSR_RFC_USER_INTERFACE Function User Creation

This module makes use of the SUSRRFCUSERINTERFACE function, through the SOAP /sap/bc/soap/rfc service, for creating/modifying users on a SAP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on,...

SAP /sap/bc/soap/rfc SOAP Service BAPI_USER_CREATE1 Function User Creation

This module makes use of the BAPIUSERCREATE1 function, through the SOAP /sap/bc/soap/rfc service, for creating/modifying users on a SAP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspire...

Pinterestclones XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Pinterestclones Multiple Vulnerabilities Author: DaOne Price: $199.99 Software Link: http://www.pinterestclones.com/ Google Dork: N/A Persistent XSS How to exploit: 1-go to : http://site.com/createusernamen/ 2-Put anything in th...

Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers

Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers Exploit Title: Symantec Web Gateway 5.0.3.18 Blind SQLi Backdoor via MySQL Triggers Date: Jul 23 2012 Author: muts Version: Symantec Web Gateway 5.0.3.18 Vendor URL: http://www.symantec.com Timeline: 12 Jun 2012:...

tomcat: password disclosure vulnerability

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

tomcat: password disclosure vulnerability

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

Bugtraq-I : Distribution for Pentesting and forensics

Bugtraq-I : Distribution for Pentesting and forensics Bugtraq system offers the most comprehensive distribution, optimal, stable and automatic security to date. Bugtraq is a distribution based on the 2.6.38 kernel has a wide range of penetration and forensic tools. Bugtraq can be installed from a...

[DSECRG-11-040] SAP NetWeaver SPML - XML CSRF user creation

DSECRG-11-040 SAP NetWeaver SPML - XML CSRF user creation Attacker can create a new user in J2EE Engine using CSRF attack on SPML service. Application: SAP NetWeaver Versions Affected: SAP NetWeaver Vendor URL: http://www.SAP.com Bugs: CSRF Reported: 14.03.2011 Vendor response: 15.03.2011 Date of...

network tracker .95 - Persistent Cross-Site Scripting

Exploit Title: Network Tracker .95 Stored XSS Date: 08-18-2011 Author: G13 Software link: http://networktracker.org/ Version: .95 ISSUE The application contains a option which allows anyone to create a user. If this option is left enabled an attacker could launch a stored XSS attack against the...

PXE Exploit Server

$Id: pxexploit.rb 13493 2011-08-05 17:10:27Z scriptjunkie $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CVE-2011-2204

Removed by vendor...

CVE-2011-2204: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-2204

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

MODx Revolution 2.0.8-pl CMS XSRF Vulnerability (Add new user)

Exploit for php platform in category web applications + Exploit Title: MODx Revolution 2.0.8-pl CMS XSRF Vulnerability Add new user + Author : ^Xecuti0n3r + E-mail : xecuti0n3ryahoo.com + Category : Web Apps XSRF + Demo Link : http://www.cmsagora.com/demo.php?id=50&type=2 + Demo Login: Username:...

HTB22978: XSRF &#40;CSRF&#41; in Argyle Social

Vulnerability ID: HTB22978 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinargylesocial.html Product: Argyle Social Vendor: Argyle Social http://argylesocial.com/ Vulnerable Version: Current at 26/04/2011 Vendor Notification: 28 April 2011 Vulnerability Type: CSRF Cross-Site Request Forgery...