CVE-2009-3727

Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error message...

Joomla! Component CB Resume Builder - SQL Injection

/ Joomla Component comcbresumebuilder Remote SQL injection vulnerability - groupid Author : kaMtiEz [email protected] Homepage : http://www.indonesiancoder.com Date : October 5, 2009 Tune In : http://antisecradio.fm choose your weapon / Software Information + Vendor : http://www.joomlacache.com/...

mybb -- multiple vulnerabilities

mybb team reports: Input passed via avatar extensions is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by uploading specially named avatars. The script allows to sign up with usernames containing zero width space characters, which can be...

Accounting Portal Authentication Bypass

www.Ostoure.com | | Ostoure Security Research Team | | Title: Accounting Portal authentication Bypass | Vendor: Parsonline - Parsway ISP | Exploitation: Remote with browser ==================== - Description: ==================== The data in the admin folder "DesktopModules" can be accessed via a...

New Bug Found By Ostoure Sazan Sharif

www.Ostoure.com | | Ostoure Security Research Team | | Title: Accounting Portal authentication Bypass | Vendor: Parsonline - Parsway ISP | Exploitation: Remote with browser ==================== - Description: ==================== The data in the admin folder "DesktopModules" can be accessed via a...

CVE-2009-2960

CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...

Server side request forgery (ssrf)

CuteFlow 2.10.3 and 2.11.0c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and passwords via a direct request...

CVE-2009-2435

The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

Cross site request forgery (csrf)

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue,...

CVE-2009-2336

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue,...

CVE-2009-2336

The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue,...

CVE-2009-2335

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...

CVE-2009-2335

WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior...

CVE-2009-2306

The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing usernames and passwords via a direct request for dvr.ini...

Improper access control

Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt...

CVE-2009-2024

Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt...

CVE-2009-2024

CVE-2009-2024 affects Vlad Titarenko ASP VT Auth 1.0. The vulnerability arises from storing sensitive information under the web root with insufficient access control, allowing remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt....

CVE-2009-2024

Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt...

Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration

source: https://www.securityfocus.com/bid/35196/info Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists. Attackers may exploit this weakness to discern valid usernames. This may aid...

Open-school 1.0 - 'id' SQL Injection

Cms : Open-school Version : 1.0 Archivo : Index.php Parametro : id Sitio :http://open-school.org Url Vulnz :http://site.com/index.php?module=osnews&view=show&id=SQLI Demo Injection: Admin User,Pass:...