Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability

Exploit for unknown platform in category web applications ========================================================== Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability ========================================================== It's possible edit the users including the admin account,...

Cuteflow 2.10.3 Security Bypass

It's possible edit the users including the admin account, bypassing the authentication through the address: http://localhost/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=st rLastName&sortdir=ASC&start=1 The vulnerability is caused due to the application not properly restricting access ...

Comersus Shopping Cart <= v6 Remote User Pass Exploit

Exploit for unknown platform in category web applications ===================================================== Comersus Shopping Cart Name Last Name Company...

Custom shortcuts can pass the wrong parameters to applications

Custom shortcut and menu commands can be used to activate external applications. In some cases, the parameters passed to these applications are not prepared correctly, and may be created from uninitialized memory. These may be misinterpreted as additional parameters, and depending on the...

Gallarific - Multiple Script Direct Request Authentication Bypass

source: https://www.securityfocus.com/bid/28163/info Gallarific is prone to a cross-site scripting vulnerability and multiple authentication-bypass vulnerabilities. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

CVE-2006-6743

phpProfiles before 2.1.1 uses world writable permissions for certain profile files and directories, which allows local users to modify or delete files, related to 1 users/include/domakeprofile.inc.php and 2 users/include/copy.inc.php...

CVE-2004-0391

Cisco Wireless LAN Solution Engine WLSE 2.0 through 2.5 and Hosting Solution Engine HSE 1.7 through 1.7.3 have a hardcoded username and password, which allows remote attackers to add new users, modify existing users, and change configuration...

CVE-2001-1069

libCoolType library as used in Adobe Acrobat acroread on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior...

CVE-2000-0604

CVE-2000-0604 involves the gkermit component on Red Hat Linux installed with the setgid uucp bit, enabling local users to modify files owned by uucp. The underlying issue is an improper installation/permission setup of gkermit, which allows a local attacker to gain partial access to files owned b...

lyris.3-4.txt

Versions 3 and 4 of the Lyris List Manager allow any mailing list subscriber to gain access to the administrative interface of that list. After a user has logged in, they may modify the generated web page as follows to gain access: Save the html to disk, and add the full path to the server into t...

CVE-2000-0502

Mcafee VirusScan 4.03 does not properly restrict access to the alert text file before it is sent to the Central Alert Server, which allows local users to modify alerts in an arbitrary fashion...

CVE-1999-0086

AIX routed allows remote users to modify sensitive files...

Microsoft Windows NT 4.0 - DCOM Server

source: https://www.securityfocus.com/bid/624/info It is possible for a local user to modify how DCOM servers are run, thereby escalating his/her privilege level. The Interactive User has write permissions to the DCOM registry entries. By editing the registry keys associated with DCOM server...

CVE-1999-1172

By design, Maximizer Enterprise 4 calendar and address book program allows arbitrary users to modify the calendar of other users when the calendar is being shared...