CVE-2011-1402

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

PT-2011-3100

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.3.6 Description The issue allows remote authenticated users to bypass intended access restrictions. This can lead to various unauthorized actions such as suspending a user account, editing or visiting a view, editing...

CVE-2011-1402: Undefined Security Weakness

Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a reque...

WebsiteBaker 2.8.1 Path Disclosure / SQL Injection

=================================== Vulnerability ID: HTB22929 Reference: http://www.htbridge.ch/advisory/multiplepathdisclosureinwebsitebaker.html Product: WebsiteBaker Vendor: Website Baker Org http://www.websitebaker2.org/ Vulnerable Version: 2.8.1 Vendor Notification: 29 March 2011...

Free Simple Software SQL Injection

'Free Simple Software' SQL Injection Vulnerability CVE-2010-4298 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in the 'Free Simple Software' download module which allows for a 'UNION SELECT' to easily expose the application...

CVE-2010-3026: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open Blog 1.2.1, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests to admin/users/edit that grant administrative privileges...

CMS Ignition - SQL Injection

CMS Ignition - SQL Injection |------------------------------------------------| | neavorc@gmaildotcom | ================================================== + SQL Injection Vulnerability + Dorks: allinurl:"shop.htm?shopMGID=" + Bug in shop.htm?shopMGID + Exploit:...

CMS Ignition SQL Injection Exploit

Exploit for php platform in category web applications ================================== CMS Ignition SQL Injection Exploit ================================== + SQL Injection Vulnerability + Dorks: allinurl:"shop.htm?shopMGID=" + Bug in shop.htm?shopMGID + Exploit:...

CVE-2010-2039

Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...

gpEasy 1.6.1 Cross Site Request Forgery

============================================= gpEasy Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/ Version: 1.6.1...

Debian DSA-2015-1 : drbd8 - privilege escalation

A local vulnerability has been discovered in drbd8. Philipp Reisner fixed an issue in the drbd kernel module that allows local users to send netlink packets to perform actions that should be restricted to users with CAPSYSADMIN privileges. This is a similar issue to those described by...

Litespeed Web Server 4.0.12 - Cross-Site Request Forgery (Add Admin) Cross-Site Scripting

Litespeed Web Server 4.0.12 - Cross-Site Request Forgery Add Admin Cross-Site Scripting Author: d1dn0t didnotatmedotcom Software Link: http://www.litespeedtech.com/litespeed-web-server-downloads.html Version: 4.0.12 Greetz: Muts/Ryujin/KernelSaunders 0x00 Product Description LiteSpeed Web Server ...

Litespeed Web Server 4.0.12 - Cross-Site Request Forgery (Add Admin) / Cross-Site Scripting

Author: d1dn0t didnotatmedotcom Software Link: http://www.litespeedtech.com/litespeed-web-server-downloads.html Version: 4.0.12 Greetz: Muts/Ryujin/KernelSaunders 0x00 Product Description LiteSpeed Web Server is the leading high-performance, high-scalability web server. It is completely Apache...

Blog System 1.x SQL Injection

Script : Blog System Version : 1.x Link : http://netartmedia.net/blogsystem/ Author : BorN To K!LL - h4ck3r Dork : "powered by Blog System" Table : websiteadminadminusers Columns : id,username,password,type Exploit :...

Blog System 1.x (note) SQL Injection Vuln

Exploit for unknown platform in category web applications ========================================= Blog System 1.x note SQL Injection Vuln ========================================= Script : Blog System Version : 1.x Link : http://netartmedia.net/blogsystem/ Dork : "powered by Blog System" Table ...

Blog System 1.x - 'note' SQL Injection

Script : Blog System Version : 1.x Link : http://netartmedia.net/blogsystem/ Dork : "powered by Blog System" Table : websiteadminadminusers Columns : id,username,password,type Exploit :...

Get all Windows Admin Users and Groups over WMI (win)

Get all Windows non System Services and Eventlog Servicestate over WMI. OpenVAS Vulnerability Test $Id: GSHBWMIgetAdminUsers.nasl 7279 2017-09-26 13:40:36Z cfischer $ Get all Windows Admin Users and Groups over WMI win Authors: Thomas Rotter Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Get all Windows Admin Users and Groups over WMI - Windows

Get all Windows non System Services and Eventlog Servicestate over WMI. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...

CVE-2009-3248

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...