4686 matches found
SA-2008-019 - Refine by Taxonomy - Cross site scripting
Refine by Taxonomy is a module that provides a taxonomy browsing user interface. Taxonomy terms are not escaped before display, making it possible to inject arbitrary HTML and script code into pages which contain the Refine by Taxonomy feature. This may lead to administrator access if certain...
SA-2008-10 - Archive - Cross site scripting
The Archive module provides a replacement for the archive functionality that was present in Drupal 4.7. Certain URL arguments are not escaped before display. It is therefore possible to inject arbitrary HTML and script code into certain archive pages, which may lead to administrator access if...
hc-multi.txt
Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...
Hosting Controller 6.1 Hot fix <= 3.3 Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ===================================================================== Hosting Controller 6.1 Hot fix = 3.3 Multiple Remote Vulnerabilities ===================================================================== Title: Multiple Security Bugs ...
Wordpress Cookie Authentication Vulnerability
Wordpress Cookie Authentication Vulnerability Original release date: 2007-11-19 Last revised: 2007-11-19 Latest version: http://www.cl.cam.ac.uk/users/sjm217/advisories/wordpress-cookie-auth.txt CVE ID: pending Source: Steven J. Murdoch http://www.cl.cam.ac.uk/users/sjm217/ Systems Affected:...
CVE-2003-1488: Improper Input Validation
The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...
To the anonymous Phpbb visitor administrator permissions-bug warning-the black bar safety net
Visit a phpbb site, close firefox, double-click the exe, and then browse the site, already has administrator privileges. - the problem also things out in a cookie on | / Paisterist's code was nice but heres mil's version. precompiled: http://www.milw0rm.com/sploits/897.rar Usage: bcc32 897.cpp an...
Adobe Connect企业服务器信息泄露漏洞
BUGTRAQ ID: 25640 CVECAN ID: CVE-2007-4651 Adobe Connect之前名为Macromedia Breeze，是企业级的网络通讯解决方案。 Adobe Connect企业服务器没有正确的验证某些输入，可能允许用户访问某些只有管理员才可以访问页面，导致信息泄露。 Adobe Connect 6 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://download.macromedia.com/pub/connect/updaters/patchto602r389a2.zip...
CVE-2007-4651
CVE-2007-4651 affects Adobe Connect Enterprise Server 6. The connected sources indicate an input validation issue that allows non‑admin users to access pages intended for administrators, causing an information disclosure vulnerability (restricted pages readable by non‑admins). Details in the Seeb...
Adonis privilege escalation
By using shell characters problem administrator can access device with root privileges...
IBM Lotus Notes information leak
Administrator can enable debugging function to log all user's passwords...
Vista inherits the recovery center system vulnerability to bypass all security protective measures-vulnerability warning-the black bar safety net
Everyone knows a very distant Windows design vulnerability: the System Restore Control Center. Through this platform, you can get administrator access, any view hard disk for any file. The most critical is that it actually does not require you to provide any username or password can be used. To u...
Image pager - Cross site scripting
The Image Pager module uses JavaScript to collect selected images from a page and display them one at a time in a block with previous/next pager links. HTML entities are decoded by the DOM functions used by Image Pager before being reinserted into the web page for display. As a result, a maliciou...
Then the storm BBSxp 7.0 Beta 2 vulnerability-vulnerability warning-the black bar safety net
The vulnerability exists in the file setup. asp The first part of the Registration－login-post-edit-capture-package-promoted to administrator-change background-password - login backend-WEBSHELL Here I set the password as: ttfct1 ,NC submitted successfully provided for the administrator. With...
[SA23895] Drupal Acidfree Module "node titles" SQL Injection Vulnerability
TITLE: Drupal Acidfree Module "node titles" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA23895 VERIFY ADVISORY: http://secunia.com/advisories/23895/ CRITICAL: Less critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: Drupal Acidfree Module 4.x http://secunia.com/product/13326/...
[Full-disclosure] [DRUPAL-SA-2007-001] Drupal 4.6.11 / 4.7.5 fixes XSS issue
---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2007-001 ---------------------------------------------------------------------------- Project: Drupal core. Date: 2007-Jan-05. Security risk: Less critical. Exploitable from: Remote...
Help Tip - Multiple vulnerabilities
The contributed module Help Tip bypasses Drupal's database API and uses user-supplied data unescaped in queries, allowing malicious users to execute SQL injection attacks. These attacks may lead to administrator access. Node titles are not properly sanitised before being used in block titles. Thi...
SYMSA-2006-012: 2X ThinClientServer Create Admin Account Replay Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2006-012 Advisory Title: 2X ThinClientServer Create Admin Account Replay Vulnerability Author: Oliver Karow / [email protected] Release Date:...
CVS management/tracker XSS
The motivation field of the CVS application page is not passed through checkmarkup on display. A malicious user may use this field to insert and execute XSS Cross Site Scripting. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. Revoking the...
