HDWiki 5.1 arbitrary User Password Change vulnerability and fix-vulnerability warning-the black bar safety net

HDWiki reset the password there is a logical vulnerability, the attacker can modify any user password. Detailed description: control/user.php function dogetpass ...... elseifisset$this-post'verifystring' $uid=$this-post'uid'; $encryptstring=$this-post'verifystring';...

YVS Image Gallery - SQL Injection

YVS Image Gallery - SQL Injection -=+ Application: YVS Image Gallery -=+ Version: 0.0.0.1 -=+ Vendor's URL: http://yvs.vacau.com/gallery.html -=+ Platform: Windows\Linux\Unix -=+ Bug type: Sql INJECTIONS -=+ Exploitation: Remote -=- -=+ Author: Corrado Liotta Aka CorryL corryl80atgmaildotcom -=+...

Low: Red Hat Security Advisory: Red Hat Network Satellite spacewalk-backend security and bug fix update

Updated spacewalk-backend packages that fix one security issue and two bugs are now available for Red Hat Network Satellite 5.4. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Low: Red Hat Security Advisory: Red Hat Network Proxy spacewalk-backend security and bug fix update

Updated spacewalk-backend packages that fix one security issue are now available for Red Hat Network Proxy 5.4. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

FCMS_2.7.2 cms and earlier multiple CSRF Vulnerabilities

Exploit for php platform in category web applications FCMS2.7.2 cms and earlier multiple CSRF Vulnerability =================================================================================== Exploit Title: FCMS2.7.2 cms multiple CSRF Vulnerability Download link...

[20111102] - Core - Password Change

Weak random number generation during password reset leads to possibility of changing a user's password...

SuSE 10 Security Update : glibc (ZYPP Patch Number 7659)

The implementation of the blowfish based password hashing method had a bug affecting passwords that contain 8bit characters e.g. umlauts. Affected passwords are potentially faster to crack via brute-force methods. CVE-2011-2483 SUSE's crypt implementation supports the blowfish password hashing...

Cross-Site Scripting vulnerability in SWAT

Description All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool SWAT. On the "Change Password" field, it is possible to insert arbitrary content into the "user" field. This issue is only exploitable if CVE-2011-2522 has not be...

Fedora Update for curl FEDORA-2011-8586

Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2011-8586 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

CVE-2011-0197

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

South data enterprise 0day vulnerability affects versions: v10. 0 v11. 0-vulnerability warning-the black bar safety net

A direct proof of the user password. Take the shell method looks like there are 3 kinds of 1, registered users to upload get a shell, this comparison directly, can not into the background and don't know the username and password case. 2, into the background of the BACKUP DATABASE 3, in the site...

DEBIAN-CVE-2011-1433

The 1 AgentInterface and 2 CustomerInterface components in Open Ticket Request System OTRS before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the UserLogin and UserPW fiel...

CA ARCserve D2D r15 - Web Service Servlet Code Execution

CA ARCserve D2D r15 - Web Service Servlet Code Execution Computer Associates ARCserve D2D r15 Web Service Apache Axis2 World Accessible Servlet Code Execution Vulnerability Poc product homepage: https://support.ca.com/phpdocs/0/8363/support/arcserved2dsupport.html vulnerability: The Tomcat Server...

WikiWebHelp 0.3.3 - Cross-Site Request Forgery

WikiWebHelp 0.3.3 - Cross-Site Request Forgery Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail: [email protected] CMS: WikiWebHelp The entire system is vulnerable to CSRF Cross-site request forgery since this does not include a system to prevent CSRF attacks ... Example...

WikiWebHelp 0.3.3 - Cross-Site Request Forgery

Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail: [email protected] CMS: WikiWebHelp The entire system is vulnerable to CSRF Cross-site request forgery since this does not include a system to prevent CSRF attacks ... Example Change the password of users, including the...

ecshop modify any user password vulnerability XSS exploit-vulnerability warning-the black bar safety net

Currently ecshop presence of the reflection typeXSS, you can use, if the secondary development existXSSor other CSRF problem, then use more. Once encountered this problem, slightly affected by its damage） ByXSSstructure post submission of personal information is modified, the modification is...

Sql injection

SQL injection vulnerability in index.php in Seagull 0.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via the frmQuestion parameter in a retrieve action, in conjunction with a user/password PATHINFO...

CVE-2010-3212

SQL injection vulnerability in index.php in Seagull 0.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via the frmQuestion parameter in a retrieve action, in conjunction with a user/password PATHINFO...

Seagull v0.6.7 SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================== Seagull v0.6.7 SQL Injection Vulnerability ========================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ ...

Seagull 0.6.7 - SQL Injection

1 1 0 Sweet the Algerian Haxxor 0 1 0 0 1 1 +Exploit Title: seagull-0.6.7 SQLinjection Vulnerabilitie 0 0 +Date: 29/08/2010 1 1 +Author: Sweet 0 0 +Contact : [email protected] 0 1 +Software Link: http://seagullproject.org/ 0 0 +Download: 1 1 +Version: 0.6.7 and lesser 0 0 +Tested on: WinXp sp3 ...