Jobscript4Web 3.5 - Multiple Cross-Site Request Forgery Vulnerabilities

Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link: http://www.jobscript4web.com/ Version: 3.5 CVE : /\ == \ /\ \ /\ \ \ \ input name="Submit" type=...

Recipe Script 5.0 - Arbitrary File Upload Cross-Site Request Forgery Cross-Site Scripting

Recipe Script 5.0 - Arbitrary File Upload Cross-Site Request Forgery Cross-Site Scripting ----------------------------------------------------------------------------------------------- Title: Recipe Script v5.0 Shell Upload/XSRF/XSS Multiple Vulnerabilities Author: Milos Zivanovic Email:...

iGaming CMS v1.5 CSRF Vulnerability

No description provided by source. NeX of the HackTalk team has found a CSRF Vulnerability in iGaming CMS v 1.5 that allows an attacker to make new administrative account, and run SQL queries. Pentest Information: ============ NeX has discovered a Cross Site Request ForgeryCSRF vulnerability in...

DubSite CMS 1.0 - Cross-Site Request Forgery

Pentest Information: ==================== Connection has discovered a Cross Site Request ForgeryCSRF vulnerability in DubSite CMS v1.0 Details ======= Tested on OS: Windows XP Tested with Software: Mozilla Firefox 3.5.x Vulnerable Products: DubSite CMS Affected Versions: 1.0 Vulnerability Type:...

Viscacha 0.8 Gold - Persistent Cross-Site Scripting

Viscacha 0.8 Gold persistant XSS vulnerability Found By: mrme Download: http://www.viscacha.org/ Tested On: Windows Vista Note: For educational purposes only POC Info: A regular user of the board can embed javascript code that could be executed within the context of the admin's browser. If the us...

CVE-2009-3949

CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier (cp/profile.php). The root cause is missing administrative authentication for the donewauthor action, allowing remote attackers to create administrative accounts via the name, password, and conf_password parameters. Exploitation is net...

Apache Tomcat for Windows backdoor account

admin account with empty password is created during installation...

Default Password (infoblox) for 'admin' Account

The account 'admin' on the remote host has the password 'infoblox'. An attacker may leverage this issue to gain total control of the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin"; password = "infoblox"; include'deprecatednasllevel.inc'; include'compat.inc...

IPSwitch IMAP Server 9.20 Overflow

/ Ipsbitch.cpp vs Ipswitch IMAP Tested on: Windows 2000 SP4 Ref: CVE-2007-2795 Author: Dominic Chell Found this half written on a VM so decided to finish it. Payload adds a local admin account USER=r00t PASS=r00tr00t!! / include "stdafx.h" include include include include include "winsock2.h" prag...

Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability

Exploit for unknown platform in category web applications ========================================================== Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability ========================================================== It's possible edit the users including the admin account,...

WordPress 2.8.3 Admin Reset Password

============================================= - Release date: August 10th, 2009 - Discovered by: Laurent Gaffié - Severity: Medium ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.3 Remote admin reset password II. BACKGROUND...

wordpress -- remote admin password reset vulnerability

WordPress reports: A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database usually the admin account would have its password reset and a new passwor...

WHOISCART (Auth Bypass) Information Disclosure Vulnerability

Exploit for unknown platform in category web applications ============================================================ WHOISCART Auth Bypass Information Disclosure Vulnerability ============================================================...

Authentication flaw

MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record in a MIDAS cookie...

CVE-2009-2231

CVE-2009-2231 affects MIDAS 1.43 and describes a remote authentication bypass in which an admin account record stored in a MIDAS cookie can grant administrative access. The vulnerability allows bypassing login to obtain admin privileges via the cookie. No explicit fix/versioned remediation is pro...

CVE-2009-2231

MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record in a MIDAS cookie...

MikroTik RouterOS with Blank Password (HTTP)

The remote host is running MikroTik RouterOS without a password for its 'admin' account. Anyone can connect to it and gain administrative access to it. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid39420; scriptversion"1.20"; scriptcvsdate"Date: 2018/11/15 20:50:25"...

Default credentials

The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access...

CVE-2008-6824

The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access...

CVE-2008-6824

CVE-2008-6824 affects the A-LINK WL54AP3 and WL54AP2 access points where the management interface uses a blank default admin password. This allows remote attackers to obtain full access via a network attack. The NVD entry documents a base score of 10.0 (HIGH) with network, low complexity, and no ...