CVE-2008-7221

RunCMS 1.6.1 is affected by a CSRF vulnerability that lets remote attackers hijack administrator sessions by sending crafted requests to system/admin.php, enabling (1) addition of new administrators or (2) modification of user profiles. The vulnerability is triggered through authenticated admin a...

CVE-2008-7188

CVE-2008-7188 affects ClipShare 2.6, where an attacker can bypass access restrictions by altering a uid parameter in siteadmin/useredit.php to modify arbitrary user profiles. This can be combined with using the manipulated email to trigger recoverpass.php, potentially recovering a user’s password...

Job2C 4.2 - profile Arbitrary File Upload

Job2C 4.2 - profile Arbitrary File Upload || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

Code injection

PhpWebGallery 1.7.0 and 1.7.1 allows remote authenticated users with advisor privileges to obtain the real e-mail addresses of other users by editing the user's profile...

CVE-2008-1729

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to 1 edit the profile pages of arbitrary users, and obtain sensitive information from 2 tracker and 3 blog pages, related to a missing check for the "access content" permission; and 4 allows remote...

MoinMoin MOIN_ID Cookie userform Action Traversal Arbitrary File Overwrite

The remote host is running MoinMoin, a wiki application written in Python. The version of MoinMoin installed on the remote host fails to validate input to the 'MOINID' cookie before using it to read and write user profiles. By providing the name of a file that exists on the remote host and is...

CVE-2007-6497

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...

Design/Logic Flaw

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...

CVE-2007-6497

Hosting Controller 6.1 Hot fix 3.3 and earlier 1 allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and 2 allows remote authenticated users to change a credit amount and increase a discount via an...

CVE-2007-6497

CVE-2007-6497 affects Hosting Controller 6.1 Hotfix 3.3 and earlier. The vulnerability allows an unprivileged remote attacker to change arbitrary user profiles via Hosting/Addreseller.asp by supplying modified loginname and email, and allows remote authenticated users to modify account attributes...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Recently updated links for users with personal spaces link to profile if personal space is not accessible

Users without the global access right for personal space can still see links to personal spaces in the "Recently updated" list on their dashboard. This is a serious security problem for extranets, when one wants to prevent non anonymous external users to see who's using the wiki. Note: this probl...

Code injection

Unspecified vulnerability in the Nodefamily module for Drupal 5.x before 5.x-1.0 allows remote authenticated users to access and modify other users' profiles via unspecified URL parameters...

Nodefamily - Access bypass

Nodefamily is needed for building user profiles with the nodeprofile module. By manipulating URL arguments, authenticated users are able to access and modify the profile of other users. Versions affected Nodefamily for Drupal 5.x before 5.x-1.0 Nodefamily for 4.7.x is not affected. Drupal core is...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information...

CVE-2007-1174

Multiple cross-site scripting XSS vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information...

CVE-2007-1174

Multiple cross-site scripting XSS vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information...

CVE-2007-1174

Multiple cross-site scripting XSS vulnerabilities in WebAPP before 20070214 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to unspecified fields in user Profiles. NOTE: some of these details are obtained from third party information...

CVE-2007-1174

CVE-2007-1174 describes multiple XSS vulnerabilities in WebAPP prior to 20070214, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors related to user Profiles. The NVD entry lists a base CVSS v2 score of 4.3 (Medium) with impact: integrity partially affected, confide...

Snitz Forums 2000 v3.1 SR4 (pop_profile.asp) SQL Injection Vulnerability

No description provided by source. =================================X=O=R=O=N================================= Snitz Forums 2000 Version 3.1 SR4 popprofile.asp Remote SQL Injection Vulnerability =================================X=O=R=O=N================================= Bulan: xoron xoron.info -...