CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

Design/Logic Flaw

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

Zomato: User Profiles Leak PII in HTML Document for Mobile Browser User Agents

@chriszielinski found that user personal information was leaking when you make a request using mobile user agent...

Tweep - An Advanced Twitter Scraping Tool

Tweep is an advanced Twitter scraping tool written in python that allows for scraping Tweets and pictures from Twitter profiles without using Twitter's API. Benefits Some of the benefits of using Tweep vs Twitter API: Fast initial setup Can be used anonymously No rate limitations Can fetch all...

Description of the security update for Outlook 2016: June 13, 2017

None None...

Appointment Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Test...

UPM Doesn't Migrate Local User Profiles Since Version 5.4.1

In UPM 5.4.1 and later versions, UPM doesn't migrate local user profiles to UPM store. Then users who are using local profile is unable to retain their personal settings by UPM...

UPM 5.2: Getting temporary profiles

Getting temporary profiles...

Profiles Are Not Written Back to User Store on Logoff

Under certain circumstances User Profiles are not written back to the UPM User Store during log off...

Nextcloud: Information disclosure

Hello Nextcloud go to https://help.nextcloud.com/users/.json for example https://help.nextcloud.com/users/amirie.json you can see the user information...

UserProfilesView - View User Profiles Information On Your Windows

UserProfilesView displays the list of all user profiles that you currently have in your system. For each user profile, the following information is displayed: Domain\User Name, Profile Path, Last Load Time, Registry File Size, User SID, and more. You can save the profiles list into...

Drupal UC Profile Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.UC Profile is one of the modules used to create and configure user profiles and files. An information disclosure vulnerability exists in the Drupal UC Profile module in versions 6.x-1.x...

Ebay Magento Commerce Cross Site Scripting

Document Title: =============== Magento Bug Bounty 22 - Profile Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1636 Magento Security ID: APPSEC-1121 Release Date: ============= 2015-11-06 Vulnerability Laboratory ID VL-ID:...

Exponent CMS 2.3.1 - Multiple XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple Exponent CMS Cross-Site Scripting Vulnerabilies Discovered by- Mayuresh Dani email protected Narendra Shinde email protected Vendor Homepage: http://www.exponentcms.org/ Software Link:...

Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities

Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities Exploit Title: Multiple Exponent CMS Cross-Site Scripting Vulnerabilies Discovered by- Mayuresh Dani [email protected] Narendra Shinde [email protected] Vendor Homepage: http://www.exponentcms.org/ Software Link:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

CVE-2014-9438

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

vBulletin Moderator Control Panel 4.2.2 CSRF

Exploit Title: vBulletin Moderator Control Panel CSRF Google Dork: "Powered by vBulletin® Version 4.2.2" Date: 16-12-2014 Exploit Author: Tomescu Daniel http://daniel-tomescu.com https://rstforums.com/forum Vendor Homepage: http://www.vbulletin.com/en/vb4-features/ Software Link: Premium Version:...

MyBB User Social Networks Plugin 1.2 - Persistent Cross-Site Scripting

MyBB User Social Networks Plugin 1.2 - Persistent Cross-Site Scripting Exploit Title: User Social Networks MyBB Plugin 1.2 - Cross Site Scripting Google Dork: N/A Date: 05.09.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage - N/A Software Link:...