HybridAuth 2.1.2 Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| HybridAuth = 2.1.2 Remote Code Execution Website : http://hybridauth.sourceforge.net/ Exploit Author : @u0x Pichaya Morimoto Release dates :...

Hosting Controller 6.1 User Profile Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13816/info Hosting Controller is prone to an unauthorized access vulnerability. Reportedly an authenticated user can modify other user's profiles. This issue is due to a failure in the application to perform proper...

Persistent Cross Site Scripting Flaw in User Profiles

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46664. panel A persistent cross site scripting flaw exists in user profiles when the user updates his/her Homepage URL from the...

Persistent Cross Site Scripting Flaw in User Profiles

A persistent cross site scripting flaw exists in user profiles when the user updates his/her Homepage URL from the Atlassian ID system to contain an XSS vector which executes when inserted as a link, and clicked on by the victim. 1. Visit https://id.atlassian.com/profile/ 2. Update your Homepage...

Persistent Cross Site Scripting Flaw in User Profiles

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46664. panel A persistent cross site scripting flaw exists in user profiles when the user updates his/her Homepage URL from the...

Persistent Cross Site Scripting Flaw in User Profiles

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46664. panel A persistent cross site scripting flaw exists in user profiles when the user updates his/her Homepage URL from the...

Liferay Portal 6.2.0 CE GA1 Multiple XSS

According to its self-reported version number, the version of Liferay Portal running on the remote host is 6.2.0. It is, therefore, potentially affected by the following cross-site scripting vulnerabilities : - Input passed from page titles is not sanitized before it is displayed in the Recycle...

HackerOne: javascript: and mailto: links are allowed on users' profiles

For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...

Windows Gather Skype, Firefox, and Chrome Artifacts

Gathers Skype chat logs, Firefox history, and Chrome history data from the target machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'csv' class MetasploitModule 'Windows Gather Skype, Firefox, and Chrom...

Facebook Privacy Feature Gone for Good

Late last year the world’s largest social network announced that it would begin removing a popular privacy feature that let users regulate whether other users could search for and locate their profiles with the Facebook search function. At the time of its initial announcement, the social networki...

Persistent XSS in Username field

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46732. panel The XSS vulnerability is only present in some parts of the UI where the username is incorrectly marked as "safe" f...

Microsoft's Social network Yammer vulnerable to OAuth Bypass hack

Yammer, is the Enterprise Social Network service that was launched in 2008 and sold to Microsoft in 2012. Yammer is a secure, private social network for your company. Yammer is used for private communication within organizations or between organizational members and pre-designated groups, making ...

Windows Gather Spark IM Password Extraction

This module will enumerate passwords stored by the Spark IM client. The encryption key is publicly known. This module will not only extract encrypted password but will also decrypt password using public key. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2012-5586

The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."...

Design/Logic Flaw

The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."...

CVE-2012-5586

The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."...

MyBB Plugin MyYoutube 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MyYoutube MyBB plugin SQL UPDATE injection. Google Dork: inurl:member.php intext:"Youtube Video" intitle:"Profile of" Date: 12.10.2012 Exploit Author: Zixem Vendor Homepage: http://www.mybb-es.com Software Link:...

SA-CONTRIB-2012-117 - Location - Access Bypass

The Location module allows real-world geographic locations to be associated with Drupal nodes, including people, places, and other content. The Location Search sub-module adds a search page for searching for locations. The Location Search module fails to enforce content and user access permission...

Multi Gather Skype User Data Enumeration

This module will enumerate Skype account settings, contact list, call history, chat logs, file transfer history, and voicemail logs, saving all the data to CSV files for analysis. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather WinSCP Saved Password Extraction

This module extracts weakly encrypted saved passwords from WinSCP. It searches for saved sessions in the Windows Registry and the WinSCP.ini file. It cannot decrypt passwords if a master password is used. This module requires Metasploit: https://metasploit.com/download Current source:...