2606 matches found
SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection
Exploit Title: Silverstripe = 2.3.5 Cross Site Request Forgery & Open Redirection. Date: 12/01/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Vendor: www.silverstripe.org | Version: 2.0.0 Tested on: PHP Open Redirection: OWASP: An open redirect is an application that...
Easy and sun Shopping Mall v1. 4Cookies injection vulnerability-vulnerability warning-the black bar safety net
Easy and sun Shopping Mall v1. 4Cookies injection vulnerability This injection vulnerability seems to occur in the Home Shopping system. Looks like the network fun. The problem occurs in getpwd4. asp page. See the code: % username=request"username" passwd=md5trimrequest. form"passwd",1 6 set...
Jobscript4Web 3.5 Multiple CSRF Vulnerability
Exploit for unknown platform in category web applications ============================================= Jobscript4Web 3.5 Multiple CSRF Vulnerability ============================================= Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link:...
Jobscript4Web 3.5 XSRF
/\ == \ /\ \ /\ \ \ \ ================================================================ // CSRF to Change Admin Password ========================================================...
Jobscript4Web 3.5 - Multiple Cross-Site Request Forgery Vulnerabilities
Jobscript4Web 3.5 - Multiple Cross-Site Request Forgery Vulnerabilities Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link: http://www.jobscript4web.com/ Version: 3.5 CVE : /\ == \ /\ \ /\ \ \ \ input type="hidde...
Jobscript4Web 3.5 Multiple CSRF Vulnerability
No description provided by source. Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link: http://www.jobscript4web.com/ Version: 3.5 CVE : /\ == \ /\ \ /\ \ \ \ \ \ \ \ \ /\ \ \ \ \ \ \ \ // // // 01000010 01101001 01001111...
Jobscript4Web 3.5 - Multiple Cross-Site Request Forgery Vulnerabilities
Title: Jobscript4Web 3.5 Multiple CSRF Vulnerability Date: 17/12/2009 Author: bi0 Software Link: http://www.jobscript4web.com/ Version: 3.5 CVE : /\ == \ /\ \ /\ \ \ \ input name="Submit" type=...
Recipe Script 5.0 - Arbitrary File Upload Cross-Site Request Forgery Cross-Site Scripting
Recipe Script 5.0 - Arbitrary File Upload Cross-Site Request Forgery Cross-Site Scripting ----------------------------------------------------------------------------------------------- Title: Recipe Script v5.0 Shell Upload/XSRF/XSS Multiple Vulnerabilities Author: Milos Zivanovic Email:...
iGaming CMS v1.5 CSRF Vulnerability
No description provided by source. NeX of the HackTalk team has found a CSRF Vulnerability in iGaming CMS v 1.5 that allows an attacker to make new administrative account, and run SQL queries. Pentest Information: ============ NeX has discovered a Cross Site Request ForgeryCSRF vulnerability in...
DubSite CMS 1.0 - Cross-Site Request Forgery
Pentest Information: ==================== Connection has discovered a Cross Site Request ForgeryCSRF vulnerability in DubSite CMS v1.0 Details ======= Tested on OS: Windows XP Tested with Software: Mozilla Firefox 3.5.x Vulnerable Products: DubSite CMS Affected Versions: 1.0 Vulnerability Type:...
Viscacha 0.8 Gold - Persistent Cross-Site Scripting
Viscacha 0.8 Gold persistant XSS vulnerability Found By: mrme Download: http://www.viscacha.org/ Tested On: Windows Vista Note: For educational purposes only POC Info: A regular user of the board can embed javascript code that could be executed within the context of the admin's browser. If the us...
CVE-2009-3949
CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier (cp/profile.php). The root cause is missing administrative authentication for the donewauthor action, allowing remote attackers to create administrative accounts via the name, password, and conf_password parameters. Exploitation is net...
Apache Tomcat for Windows backdoor account
admin account with empty password is created during installation...
Default Password (infoblox) for 'admin' Account
The account 'admin' on the remote host has the password 'infoblox'. An attacker may leverage this issue to gain total control of the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin"; password = "infoblox"; include'deprecatednasllevel.inc'; include'compat.inc...
IPSwitch IMAP Server 9.20 Overflow
/ Ipsbitch.cpp vs Ipswitch IMAP Tested on: Windows 2000 SP4 Ref: CVE-2007-2795 Author: Dominic Chell Found this half written on a VM so decided to finish it. Payload adds a local admin account USER=r00t PASS=r00tr00t!! / include "stdafx.h" include include include include include "winsock2.h" prag...
Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability
Exploit for unknown platform in category web applications ========================================================== Cuteflow 2.10.3 edituser.php Security Bypass Vulnerability ========================================================== It's possible edit the users including the admin account,...
WordPress 2.8.3 Admin Reset Password
============================================= - Release date: August 10th, 2009 - Discovered by: Laurent Gaffié - Severity: Medium ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.3 Remote admin reset password II. BACKGROUND...
wordpress -- remote admin password reset vulnerability
WordPress reports: A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database usually the admin account would have its password reset and a new passwor...
WHOISCART (Auth Bypass) Information Disclosure Vulnerability
Exploit for unknown platform in category web applications ============================================================ WHOISCART Auth Bypass Information Disclosure Vulnerability ============================================================...
