Weblate: Adding Email lacks Password validation

Affected URL: https://demo.weblate.org/accounts/email/ Issue: The account section of profile says: "You can add another email address on the Authentication tab." But there is no option of adding another email in Authentication. However, I was able to guess the above endpoint. The problem here is,...

CVE-2016-5551

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite subcomponent: NAS device addition. The supported version that is affected is 4.3. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes ...

Code injection

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite subcomponent: NAS device addition. The supported version that is affected is 4.3. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes ...

CVE-2016-5551

CVE-2016-5551 affects the Solaris Cluster NAS Device Addition component in Oracle Sun Systems Products Suite, version 4.3. The vulnerability description indicates an easily exploitable, unauthenticated access scenario that requires user interaction, potentially enabling read access to a subset of...

D-Link DGS-1510 Exploit

Exploit for hardware platform in category web applications ================ get-user-info.py ================ import re import os.path import urllib2 import base64 import gzip import zlib from StringIO import StringIO from io import BytesIO def makerequests: """Calls request functions...

CVE-2017-6962

An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the readchunk function making an unchecked addition of 12...

CVE-2017-6962

An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the readchunk function making an unchecked addition of 12...

UBUNTU-CVE-2017-5403

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. This vulnerability affects Firefox 52 and Thunderbird 52...

Authentication Bypass Vulnerability in D-Link DGS-1510 Switches

The D-Link DGS-1510 series is the next generation of intelligent managed switches. An authentication bypass vulnerability exists in the D-Link DGS-1510 Switches. The vulnerability is exploited to allow an attacker to execute commands on the switches and extract the configuration and obtain user...

CVE-2016-9315

CVE-2016-9315 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 and earlier. The issue is a privilege-escalation in the com.trend.iwss.gui.servlet.updateaccountadministration servlet, where an authenticated, low-privilege user can change the Master Admin password or add new...

XenDesktop Setup Wizard cannot add machines to an existing catalog

XenDesktop Setup Wizard fails to create new devices at the end of the wizard's process. Wizard has no issues connecting to VMWare VShere but fails to create VMs with error: CDFNETERROR,"XdSetupFinish: Clone for device XXXXX-003 exception: System.Exception: vmwware-wsnaprvmvc01 Duplicate template...

SUSE-SU-2017:0103-1 Security update for rrdtool

This update for rrdtool provides the following fixes: - CVE-2013-2131: Enhance imginfo format validation checks to prevent crashes. bsc828003 - Add rrdtool-cached sub-package to SLE 12-SP1. bsc967671...

Unable to add account on the Citrix Windows receiver

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Unable to add the account through Windows receiver...

Cross-Site Request Forgery Vulnerability in yiqicms

Yiqicms is a SEO-based marketing enterprise website system, using PHP+Mysql open source building system. yiqicms background add admin admin/user-add.php at the existence of CSRF vulnerability , through the implantation of csrf form way , you can add the administrator account...

Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)

Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link :...

CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

Nagios Network Analyzer 2.2.1 - Multiple Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: John Page hyp3rlinx + ISR: ApparitionSec Vendor: =============== www.nagios.com Product: ============================== Nagios Network Analyzer v2.2.1 Netflow Analysis, Monitoring, and Bandwidth Utilization Software Network Analyzer...

UBUNTU-CVE-2016-6296

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other...

OracleVM 3.2 : rpm (OVMSA-2016-0077)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add missing files in /usr/share/doc/ - Fix warning when applying the patch for 1163057 - Fix race condidition where unchecked data is exposed in the file system CVE-2013-64351163057 - Fix segfault on...

Espcms latest version backend has csrf vulnerability

ESPCMS enterprise website management system is a powerful enterprise website management system built on LAMP development. Espcms background csrf vulnerability, attackers can with the vulnerability to forge cross-site requests, add new administrator users, resulting in information leakage...