U.S. Dept Of Defense: Default page exposes admin functions and all metods and classes available. on https://██████/█████/dwr/index.html

Summary: https://████/██████/dwr/index.html is a default installation page of DWR engine that exposes all classes and methods available to the user. Description: https://█████████/██████████/dwr/index.html is a default installation page of DWR engine that exposes all classes and methods available...

SeaWell Networks Spectrum - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: SeaWell Networks Spectrum - Multiple Vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: http://www.seawellnetworks.com/spectrum/ Versions Reported: Spectrum SDC 02.05.00, Build 02.05.00.0016 CVE-ID: CVE-2015-8282...

Simple Fields 1.1.6 - Admin Functions CSRF

The Simple Fields WordPress plugin was affected by an Admin Functions CSRF security vulnerability...

CVE-2012-1498

Multiple cross-site request forgery CSRF vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add an administrator via an add action to admin/users/add or 2 modify a web page via a save action to...

[eVuln.com] Cookie authentication bypass in Alguest

New eVuln Advisory: Cookie authentication bypass in Alguest Summary: http://evuln.com/vulns/152/summary.html Details: http://evuln.com/vulns/152/description.html -----------Summary----------- eVuln ID: EV0152 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: high Type:...

CVE-2009-2161

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the ssuri parameter, in conjunction with a modified component name...

Design/Logic Flaw

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

CVE-2008-3033

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

CVE-2008-3033

CVE-2008-3033 concerns RSS-aggregator 1.0 where the admin/fonctions/ directory does not require administrative authentication. This allows remote attackers to access admin functions (e.g., supprimer_flux.php and modifier_tps_rafraich.php) with unspecified additional impact. The provided documents...

CVE-2008-3033: Improper Authentication

RSS-aggregator 1.0 does not require administrative authentication for the admin/fonctions/ directory, which allows remote attackers to access admin functions and have unspecified other impact, as demonstrated by 1 an IdFlux request to supprimerflux.php and 2 a TpsRafraich request to...

RSS-aggregator Multiple vulnerabilities

---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...

rssagg-sql.txt

---------------- RSS-aggregator ---------------- Informations : Langage : PHP Version : 1.0 Website : http://www.rss-aggregator.com Problems : Multiple vulnerabilities Description: RSS-aggregator is a tool, for Webmaster, allowing to display several feeds RSS on a single page. Details :...

phpBB 2.0.23 Session Hijacking Vulnerability

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ phpBB 2.0.23 Session Hijacking Vulnerability + found by NBBN 13 Mar 2008 + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ::Information about this vulnerabilty If a moderator or an admin close a thread in phpBB 2.0.X, th...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MYCONFclassRoot parameter to 1 inc.steps.accesserror.php, 2 inc.steps.checklogin.php, or 3 inc.steps.initsystem.php in admin/functions/...

CVE-2008-0423

Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MYCONFclassRoot parameter to 1 inc.steps.accesserror.php, 2 inc.steps.checklogin.php, or 3 inc.steps.initsystem.php in admin/functions/...

CVE-2008-0423: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MYCONFclassRoot parameter to 1 inc.steps.accesserror.php, 2 inc.steps.checklogin.php, or 3 inc.steps.initsystem.php in admin/functions/...

Lama Software (14.12.2007) Multiple Remote File Inclusion Vulnerabilities

No description provided by source. +----------------------------------------------------------------------------+ Lama Software kostenlos Remote file include Scripts : Lama Software kostenlos Discovered By : QTRinux Scripts site : http://www.lama-software.de/ Thanks To : Tryag.cc cold z3ro...

TorrentTrader Classic 1.07 Multiple Remote Vulnerabilities

No description provided by source. TorrentTrader Classic Mutiple Remote vulnerabilities Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Tested on TorrentTrader Classic v1.07 local file inclusion...

CVE-2007-1156

JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for admin/...

CVE-2006-6808

Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...