CVE-2007-6487

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

Design/Logic Flaw

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

CVE-2007-6487

Affected product: Plain Black WebGUI 7.4.0–7.4.17. Vulnerability arises in the admin account creation logic that allows remote authenticated users with Secondary Admin privileges to create Admin accounts (privilege escalation). No exploitation details are provided in the documents. Remediation: u...

CVE-2007-6487: Undefined Security Weakness

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

bytehoard-multi.txt

Application: Bytehoard Versions: 2.1 alpha to epsilon Release Date: 2007-11-26 Author: Ernesto Alvarez / Activesec SA Kudos to: Rodrigo Seguel / Activesec SA for suggesting the session destruction approach Contact info: ealvarez at activesec biz Developer response: None. No response to mail, foru...

sBlog 0.7.3 Beta Cross Site Request Forgery

!-- - Product : sBlog - - Version : 0.7.3 Beta - - Website : http://www.sblog.se - - Author : 0x90 - - Homepage: WwW.0x90.CoM.Ar - - Contact : Gunsat0x90dotcomdotar - - Problem : Cross Site Request Forgery Vulnerability - - Sumary : sBlog has, by default, no CSRF protection, this may allow an...

CVE-2007-5752

adduser.php in PHP-AGTC Membership AGTC-Membership System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin userlevel 4 privileges...

CVE-2007-5752: Improper Authentication

adduser.php in PHP-AGTC Membership AGTC-Membership System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin userlevel 4 privileges...

CVE-2004-2717

Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read arbitrary files via a .. dot dot in the 1 sheet and 2 What parameters...

[waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11

waraxe-2007-SA053 - Critical Sql Injection in NukeSentinel 2.5.11 ==================================================================== Author: Janek Vind "waraxe" Date: 25. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-53.html Target software description:...

waraxe-2007-SA052.txt

waraxe-2007-SA052 - dBlog CMS Open Source database retrieval ==================================================================== Author: Janek Vind "waraxe" Date: 19. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-52.html Target software description:...

Authentication flaw

captcha.php in BellaBook aka BellaBuffs allows remote attackers to obtain administrative privileges by sending the admin's username adminname in a pheaplogin cookie. NOTE: the vendor disputes this vulnerability because authentication data is derived from the adminpass and secret variables, in...

CVE-2007-4230

BellaBiblio is affected by a cookie-based privilege escalation where a bellabiblio cookie with the value “administrator” can grant remote admin privileges. The issue’s root cause involves cookie value validation, but this is disputed: several sources state the cookie value must be an MD5 hash rat...

PT-2007-5423 · Unknown · Bellabiblio

Name of the Vulnerable Software and Affected Versions: BellaBiblio affected versions not specified Description: The issue allows remote attackers to potentially gain administrative privileges. It involves setting a bellabiblio cookie with a specific value. However, it's noted that the cookie valu...

CVE-2007-4153

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 the Options Database Table in the Admin Panel, accessed through options.php; or 2 the opmlurl parameter to link-import.php. NOTE: this might...

Cross site scripting

Cross-site scripting XSS vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."...

Code injection

admin/index.php in AV Arcade 2.1b grants administrative privileges when the avauserid cookie value is 1, which allows remote attackers to perform certain administrative actions...

CVE-2007-3643

admin/index.php in AV Arcade 2.1b grants administrative privileges when the avauserid cookie value is 1, which allows remote attackers to perform certain administrative actions...

CVE-2007-3643

admin/index.php in AV Arcade 2.1b grants administrative privileges when the avauserid cookie value is 1, which allows remote attackers to perform certain administrative actions...

Design/Logic Flaw

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php...