2197 matches found
Yik Yak Patches Privacy Flaw in iOS App
Yik Yak, an application that allows users to share purportedly anonymous status updates with others near them, has fixed a critical vulnerability in its iOS app that could have de-anonymized users and let attackers take total control of someone’s account. Yik Yak’s security team was apparently...
CVE-2014-0204
OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...
PT-2014-6506
Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the user id parameter to "plugins/webform/new-form.php", which is not properly handled by "plugins/useradmin/fingeruser.php"...
mod_wsgi: possible privilege escalation in setuid() failure scenarios
It was found that modwsgi did not properly drop privileges if the call to setuid failed. If modwsgi was set up to allow unprivileged users to run WSGI applications, a local user able to run a WSGI application could possibly use this flaw to escalate their privileges on the system. Note: modwsgi i...
CVE-2014-2975
Cross-site scripting XSS vulnerability in php/useraccount.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the userid parameter...
PT-2014-4997
Name of the Vulnerable Software and Affected Versions Silver Peak VX versions prior to 6.2.4 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the user id parameter in the php/user account.php file. Recommendations For versions prior to...
UBUNTU-CVE-2014-5033
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, related to...
Bilboplanet 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Bilboplanet 2.0 - Multiple Cross-Site Scripting Vulnerabilities Exploit Title: Multiple XSS vulnerabilities in Bilboplanet application Date: 10/15/13 Exploit Author:Vivek N http://nvivek.weebly.com/ Vendor Homepage: http://www.bilboplanet.com/ Software Link:...
phpEventCalendar <= 0.2.3 (eventdisplay.php) SQL Injection Exploit
No description provided by source. !/usr/bin/perl Vendor url: www.ikemcg.com require LWP::UserAgent; print phpEventCalendar = v0.2.3 SQL Injection Exploit By Iron - ironwarez.info Thanks to Silentz for the help : Greets to everyone at RootShell Security Group & dHack Example target url:...
Invision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit
No description provided by source. !/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the target user. You need ...
Campsite 3.3.5 - CSRF Vulnerability
No description provided by source. ======================================================================= campsite 3.3.5 CSRF Vulnerability ======================================================================= by Pratul Agrawal Vulnerability found in- Admin module email [email protected]...
OpenDocMan 1.2.6.1 - Password Change CSRF
No description provided by source. Exploit Title: OpenDocMan Password Change CSRF Date: 22/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.opendocman.com/ Software Link: https://github.com/downloads/opendocman/opendocman/opendocman-1.2.6.1.tar.gz Version: 1.2.6.1 Gr33Tz:...
WordPress Zotpress plugin <= 4.4 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress Zotpress plugin = 4.4 SQL Injection Vulnerability Date: 2011-09-04 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/zotpress.4.4.zip Version: 4.4 tested Note: magicquotes...
BitchX IRC Client 1.0 c17 DNS Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2087/info BitchX is a popular Internet Relay Chat client, written by Colten Edwards. A problem exists which could potentially allow a user to access restricted resources. The problem occurs in the DNS resolution code. A...
MyBulletinBoard (MyBB) <= 1.00 RC4 SQL Injection Exploit
No description provided by source. !/usr/bin/perl -w SQL Injection Exploit for MyBulletinBoard MyBB = 1.00 RC4 This exploit show the MD5 crypted password of the user id you've chose Related advisory: Patch: http://www.mybboard.com/community/showthread.php?tid=2559 http://fain182.badroot.org...
ibProArcade <= 3.3.0 - Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl ibProArcade = v3.3.0 sql injection exploit coded by 1dt.w0lf RST/GHC THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; BEGIN if$^O eq 'MSWin32' require Win32::Console;...
WindowsPT 1.2 User ID Key Spoofing Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/24412/info WinPT Windows Privacy Tray is prone to a key-spoofing vulnerability because it fails to properly display user-supplied key data. An attacker can exploit this issue to trick victim users into encrypting...
vuBB <= 0.2 (Cookie) Final Remote SQL Injection Exploit (mq=off)
No description provided by source. !/usr/bin/perl print q ---------------------------------------------------------------------- vuBB =0.2 Final Remote SQL Injection cookies Exploit exploit discovered and coded by KingOfSKa https://contropotere.netsons.org...
Snaps! Gallery 1.4.4 - Remote User Pass Change Exploit
No description provided by source. ?php / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ /...
MyBB Follower User Plugin - SQL Injection
No description provided by source. Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:Users subscribed to inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on: Linux...