NeoScale Systems CryptoStor 700 series appliances fail to properly perform two-factor authentication

Overview NeoScale Systems CryptoStor 700 series appliances fail to properly perform two-factor authentication. This can make it easier to bypass the CryptoStor authentication process. Description NeoScale Systems CryptoStor Tape units are tape backup encryption appliances. CryptoStor 700 series...

DUware多个组件管理员访问文件上传漏洞

DUware包含多个基于WEB程序的系统，包括日历，下载，新闻系统等。DUware包含的多个程序访问验证问题，远程攻击者可以利用这个漏洞绕过验证访问敏感信息，并上传恶意文件等。DUware多个脚本没有正确的安全访问检查，攻击者可以直接访问这些管理脚本，以管理员身份控制应用程序。并可以通过提交恶意表单上传任意文件。 DUware 1.0-4.0 目前厂商已经发布了升级补丁以修复这个安全问题 请到厂商的主页下载：http://www.duware.com/home/ - Admin Access : - http://target/admin/incedit.asp?iEve=1 -...

emekportal21.txt

BiyoSecurity.Org script name : Emek Portal v2.1 tr Script Download : http://www.aspindir.com/indir.asp?id=2728 Risk : High Regards : Dj ReMix Thanks : Korsan , Liz0zim , TrIP Vulnerable file : girisyap.asp Manual connect : Go to Admin Panel Login ----- http://victim.com/path to script/uyegiris.as...

CVE-2006-5245

Summary (CVE-2006-5245): Eazy Cart is affected by a authentication bypass vulnerability in the admin area. A remote attacker can gain administrative access by issuing a direct request to a file such as admin/home/index.php (and potentially other PHP scripts under the admin/ directory), bypassing ...

Pathauto cross site scripting vulnerability

It is possible for a malicious user to execute XSS Cross Site Scripting by enticing a victim to click on a specially crafted link. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. Versions affected Please check the CVS $Id$ fields in the file...

CVE-2006-4462

Gonafish.com LinksCaffe 2.0 and 3.0 expose an access control flaw that lets remote attackers obtain full administrator rights via a direct request to Admin/admin1953.php. The affected components are the LinksCaffe admin functions, and the root cause is improper restriction of administrator-area a...

CVE-2006-4462

Gonafish.com LinksCaffe 2.0 and 3.0 do not properly restrict access to administrator functions, which allows remote attackers to gain full administration rights via a direct request to Admin/admin1953.php...

IP restrictions on admin rights

A security conscience evaluator has requested the option to restrict administration access to a range of / a specific IP address/es...

Pixelpost <= 1-5rc1-2 Remote Privilege Escalation Exploit

Exploit for unknown platform in category web applications ========================================================= Pixelpost = 1-5rc1-2 Remote Privilege Escalation Exploit ========================================================= !/usr/bin/php -q -d shortopentag=on ? echo "Pixelpost = 1-5rc1-2...

Geeklog auth.inc.php loginname Parameter SQL Injection

The version of Geeklog installed on the remote fails to sanitize input to the 'loginname' and 'passwd' parameters before using it in the script 'admin/auth.inc.php' to construct database queries. Provided PHP's 'magicquotesgpc' setting is enabled, an unauthenticated attacker can exploit this flaw...

CVE-2006-2674

Multiple SQL injection vulnerabilities in Tamber Forum 1.9.13 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 frmid parameter to a showforum.asp, 2 a search field to b forumsearch.asp, 3 Email address or 4 Password to c admin/index.asp, 5 frmcatid parameter to d...

DGNews v 1.5 File Upload Vuln.

DGNews v 1.5 File Upload Vuln. Vuln. discovered by : r0t Date: 29 may 2006 vendor:www.diangemilang.com/dgscripts.php affected versions:v 1.5 and prior orginal advisory: http://pridels.blogspot.com/2006/05/dgnews-v-15-file-upload-vuln.html Vuln. Description: It is possible to upload arbitrary file...

cosmoshop.txt

i am: l0om page: www.excluded.org product: cosmoshop 1 show all files as admin-user 2 sql injection Cosmoshop - Lse /lib/lshopartikelsql.pm, line 257 called by: main::getartikelcontentbyid hopefully this time cosmoshop will be fixed best wishes, l0om...

Phils Bookmark Script - admin.php Authentication Bypass

Phils Bookmark Script - admin.php Authentication Bypass source: https://www.securityfocus.com/bid/17878/info Phil's Bookmark script is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can...

Phil's Bookmark Script - 'admin.php' Authentication Bypass

source: https://www.securityfocus.com/bid/17878/info Phil's Bookmark script is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can exploit this issue to bypass authentication and gain admin...

PlanetGallery - Gallery_admin.php Authentication Bypass

PlanetGallery - Galleryadmin.php Authentication Bypass source: https://www.securityfocus.com/bid/17753/info PlanetGallery is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can exploit this...

PlanetGallery - 'Gallery_admin.php' Authentication Bypass

source: https://www.securityfocus.com/bid/17753/info PlanetGallery is prone to an authentication-bypass vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can exploit this issue to bypass authentication and gain admin access. Th...

Code injection

Direct static code injection vulnerability in QLnews 1.2 allows remote authenticated administrators to execute arbitrary PHP code by modifying config.php...

adv_pixelpost.txt

/ -------------------------------------------------------- Neo Security Team NST� - Advisory 19 - 04/03/06 -------------------------------------------------------- Program: Pixel Post Homepage: http://www.pixelpost.org/ Vulnerable Versions: 1.4.3, 1.5 beta1 and possibly lower versions. Risk: High...

Pixel Post Multiple Vulnerabilities

/ -------------------------------------------------------- Neo Security Team NST - Advisory 19 - 04/03/06 -------------------------------------------------------- Program: Pixel Post Homepage: http://www.pixelpost.org/ Vulnerable Versions: 1.4.3, 1.5 beta1 and possibly lower versions. Risk: High!...