ownCloud: Full Path Disclosure

When I was trying to upload a html file as profile picture as a non admin user. then it popped up with a message containing full path . Like that "Could not obtain lock type 1 on "/opt/lampp/htdocs/owncloud/data/12/files/opt/lampp/htdocs/owncloud/data/12/cache/avatarupload"." Thanks...

Cerb 7.0.3 - Cross-Site Request Forgery

Cerb 7.0.3 - Cross-Site Request Forgery Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14,...

WordPress Private Only 3.5.1 CSRF / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications Details ================ Software: Private Only Version: 3.5.1 Homepage: http://wordpress.org/plugins/private-only/ Advisory report:...

CVE-2010-5309

GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors...

Default credentials

GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors...

CSRF Vulnerability in C2Box application CVE-2015-4460

Please add this advisory to your archive. Thanks. Title: Cross-Site Request Forgery CSRF Vulnerability in C2Box application Allows adding an Admin User or reset any user's password. Author: Wissam Bashour - Help AG Middle East Vendor: boxautomationB.A.S Product: C2Box Version: All versions below...

C2Box 4.0.0(r19171) - Cross-Site Request Forgery

C2Box 4.0.0r19171 - Cross-Site Request Forgery Title: Cross-Site Request Forgery CSRF Vulnerability in C2Box application Allows adding an Admin User or reset any user's password. Author: Wissam Bashour - Help AG Middle East Vendor: boxautomationB.A.S Product: C2Box Version: All versions below...

C2Box 4.0.0(r19171) - Cross-Site Request Forgery

Title: Cross-Site Request Forgery CSRF Vulnerability in C2Box application Allows adding an Admin User or reset any user's password. Author: Wissam Bashour - Help AG Middle East Vendor: boxautomationB.A.S Product: C2Box Version: All versions below 4.0.0r19171 Tested Version: Version 4.0.0r19171...

C2Box 4.0.0 r19171 Cross Site Request Forgery

Please add this advisory to your archive. Thanks. Title: Cross-Site Request Forgery CSRF Vulnerability in C2Box application Allows adding an Admin User or reset any user's password. Author: Wissam Bashour - Help AG Middle East Vendor: boxautomationB.A.S Product: C2Box Version: All versions below...

CVE-2015-3950

CVE-2015-3950 is a CSRF vulnerability in XZERES 442SR OS (Wind Turbine 442SR) that allows a remote attacker to hijack the admin’s session by using a crafted GET request to switch the default admin user. Affected component: the 442SR OS web interface; root cause reported as CSRF via GET leading to...

IdeaCMS built Station system universal vulnerability affects thousands of sites-vulnerability warning-the black bar safety net

IdeaCMS based on the ASP+MSSQL/ACCESS technology development from 2 0 0 8 released in the first version since, every year, we are on a program to do a larger version of the update, so far has released six major versions. IdeaCMS in a simple, efficient, flexible, easy to use, open source, template...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator user via an add action to admin/index.php or 2 conduct static PHP code injection attacks via...

Simple Invoice 2011.1 Cross Site Request Forgery

Affected software: simple invoice Type of vulnerability:adding admin user via csrf URL:simpleinvoices.org Discovered by: provensec Website: provensec.com version:2011.1 Proof of concept...

Reflected XSS Vulnerability In Manage Engine Firewall Analyzer

======================================================================== =======Reflected XSS Vulnerability In Manage Engine Firewall Analyzer ======================================================================== ======= . contents:: Table Of Content Overview ======== Title : Reflected XSS...

HotExBilling Manager Cross-site scripting (XSS) vulnerability

Title: ==== HotExBilling Manager – Cross-site scripting XSS vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-2781 Date: ==== 12-03-2015 dd/mm/yyyy Vendor: ====== Hotspot Express has been in the billing solution business sinc...

MGASA-2015-0204 Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

D-Link DIR-601 Authentication Bypass Vulnerability

D-Link DIR-601 is a wireless router product. A security vulnerability in mycgi.cgi in the D-Link DIR-601 2.02NA and earlier versions allows malicious users to bypass certain security restrictions and gain access to the Adminuser, Wirelesssettings, Wirelesssecurity, Wirelesssecurity settings table...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in TinyWebGallery TWG before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that 1 add a user via an adduser action to admin/index.php or 2 conduct static PHP code injection attacks in .htusers.php...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Commerce Platform component in Oracle Commerce Platform 9.4, 10.0, and 10.2 allows remote attackers to affect integrity via vectors related to Dynamo Application Framework - HTML Admin User Interface...

CVE-2015-0510

Oracle Commerce Platform (9.4, 10.0, 10.2) is affected by a vulnerability in the Dynamo Application Framework – HTML Admin User Interface. The issue, described in connected CNVD data, allows a remote attacker to update, insert, or delete data, compromising data integrity. The root cause details a...