polarHelp.txt

Polar HelpDesk Inadequate Security Checks Summary Polar HelpDesk is "a software solution for implementation of a help desk support system on your web site". We found the product to inadequately verify whether the user logged on to the system provided username and password or the privileges that t...

Sad Raven's Guestbook версии 1.2 vuln

Приветствую! Если вам интересно, то я обнаружил уязвимость в Sad Raven's Guestbook версии 1.2. Она заключается в следующем: если установить на свою машину правильно составленный cookie, то можно войти в админский интерфейс, с частичным обходом авторизации! Кукис должен быть следующего формата: na...

[Full-Disclosure] DoS vuln in various versions of Linksys routers.

Denial of Service Vulnerability in Linksys BEFSR41 - Router vuln was identified and tested on. Linksys BEFSR41 v3 Linksys BEFSRU31 Linksys BEFSR11 Linksys BEFSX41 Linksys BEFSR81 v2/v3 Linksys BEFW11S4 v3 Linksys BEFW11S4 v4 Available from www.linksys.com October 19, 2003 Revised November 10, 200...

Multiple TTT-C XSS vulnerabilities

-------------------------------------------------------- Subject: Multiple TTT-C Turbo Traffic Trader C XSS vulnerabilityes. Author: Kaloyan Olegov Georgiev ICEFIRE Package name: Turbo Traffic Trader C TTT-C or TTT3 Sumary: Multiple XSS issues Date: 2004-05-16 Affected versions: Latest stable TTT...

Samsung SmartEther SS6215S Switch

There is a vulnerability within the OS that this and other samsung managed switches. The problem resides in the way that the admin user is authenticated when trying to login using telnet remote or from console local. Now just so everyone who reads this knows, I am not that up to date on all of...

Expinion.net News Manager Lite 2.5 - 'NEWS_LOGIN?admin' Cookie Authentication Bypass

source: https://www.securityfocus.com/bid/9935/info Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks. The issues exist in the 'commentadd.asp', 'search.asp',...

[SCAN Associates Sdn Bhd Security Advisory] PHPNuke 6.9 > and below SQL Injection in multiple module.

Products: PHPNuke 6.9 posibbly 7.x http://www.phpnuke.org Date: 10 February 2004 Author: pokleyzz pokleyzzatscan-associates.net Contributors: skatscan-associates.net shaharilatscan-associates.net muniratscan-associates.net URL: http://www.scan-associates.net Summary: PHPNuke 6.9 and below posibbl...

JBrowser 1.0/2.x - Unauthorized Admin Access

source: https://www.securityfocus.com/bid/9537/info Due to a lack of access validation to the 'admin' directory, malevolent users may be able to execute arbitrary admin scripts. This may allow a malicious user to upload arbitrary files to the affected system and gain access to files outside of th...

[SCSA-026] DUWARE Products Admin Access and Arbitrary File Upload Vulnerability

====================================================================== Security Corporation Security Advisory SCSA-026 DUWARE Products Admin Access and Arbitrary File Upload Vulnerability ====================================================================== PROGRAM: DUWARE Products HOMEPAGE:...

SCSA026.txt

====================================================================== Security Corporation Security Advisory SCSA-026 DUWARE Products Admin Access and Arbitrary File Upload Vulnerability ====================================================================== PROGRAM: DUWARE Products HOMEPAGE:...

Xtreme ASP Photo Gallery

Tripbit Security Research tripbit.org Security Advisory Advisory ID: TA-150104 Release Date: January 15th, 2004 Application: Xtreme ASP Photo Gallery 2.0 Severity: Medium/High Impact: Admin access Class: Input Validation Error Vendor: http:// www.pensacolawebdesigns.com/ Overview...

TA-150104.txt

Tripbit Security Research tripbit.org Security Advisory Advisory ID: TA-150104 Release Date: January 15th, 2004 Application: Xtreme ASP Photo Gallery 2.0 Severity: Medium/High Impact: Admin access Class: Input Validation Error Vendor: http:// www.pensacolawebdesigns.com/ Overview...

Get admin level on Goldlink script v3.0

There is a bug in script of links Goldlink v3.0 http://www.goldscripts.com/goldlink.php. You can access to panel with admin privileges. The bug is in variables.php file: function Acceso global $extension; global $tbadmin; global $HTTPCOOKIEVARS; $vadminlogin=$HTTPCOOKIEVARS"vadminlogin";...

deskpro.sql.txt

Multiple SQL Injection Vulnerabilities in DeskPRO ------------------------------------------------------------------------- Article reference: http://www.securiteam.com/unixfocus/6R0052K8KM.html SUMMARY DeskPRO http://www.deskpro.com is "an integrated script to manage your customer sales and...

Admin Access Vulnerability in Community Wizard

Admin Access Vulnerability in Community Wizard Affected Systems: Community Wizard version: 5.1 and possibly earlier versions Vendor: http://www.sepcity.com , http://www.commwiz.com Issue: gain admin access Released: 18 September 2003 Introduction: ============= "Community Wizard allows anyone to...

[UNIX] Vulnerability in Bandsite Allows Gaining Admin Access

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

bandwebsite.txt

Informations : °°°°°°°°°°°°°° - Product : Bandsite portal system - Website : http://membres.lycos.fr/fluxx/bandwebsite.php - Author : Jelle de Vos - Tested version :1.5 - Problem : vulnerability in Bandsite Allows Gaining Admin Access. Product Description : °°°°°°°°°°°°°°°°°°°°° Bandsite is an...

CVE-2003-0640

BEA WebLogic Server and Express, when using NodeManager to start servers, provides Operator users with privileges to overwrite usernames and passwords, which may allow Operators to gain Admin privileges...

diginews.txt

Digi-news and Digi-ads version 1.1 admin access without password .oO Overview Oo. Digi-news and Digi-ads version 1.1 admin access without password Discovered on 2003, March, 30th Vendor: Digi-FX Digi-news 1.1 is a PHP news editor. It allows you to easily add, edit, and delete news. Digi-ad 1.1 is...

Digi-news and Digi-ads version 1.1 admin access without password

Digi-news and Digi-ads version 1.1 admin access without password .oO Overview Oo. Digi-news and Digi-ads version 1.1 admin access without password Discovered on 2003, March, 30th Vendor: Digi-FX Digi-news 1.1 is a PHP news editor. It allows you to easily add, edit, and delete news. Digi-ad 1.1 is...