6663 matches found
Microsoft Outlook Web Access not may use correct HTTP directive
Overview Some versions of Outlook Web Access OWA may use the no-cache instead of the no-store HTTP 1.1 directive. This results in web browsers caching sensitive information. Description Some versions of Outlook Web Access may use the Cache-Control: no-cache HTTP 1.1 directive. From RFC 2616: If t...
Design/Logic Flaw
Unspecified vulnerability in Sun Ray Kiosk Mode 4.0 allows local and remote authenticated Sun Ray administrators to gain root privileges via unknown vectors related to utconfig...
Sql injection
Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...
CVE-2008-2038
Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby and 2 sort parameters. NOTE: the provenance of this information is unknown; the details are...
CVE-2008-1988
Unrestricted file upload vulnerability in the fileupload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated administrators to upload and execute arbitrary PHP files by uploading a file with an executable extension, then accessing it via a direct request to the file...
NetClassifieds Sql Injection
Aria-Security Team Persian Security Team http://Aria-Security.Net Persian http://Aria-Security.com ENG -------------------------------------------- Greetz: Aura, imm02tal, Null, Kinglet, Mormoroth http://www.scriptdevelopers.net/ tested on NetClassifieds Original Post @...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...
CVE-2008-1719
Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...
CVE-2008-1719
CVE-2008-1719 affects Nuke ET versions 3.2 and 3.4. The issue consists of multiple CSRF vulnerabilities that could allow remote attackers to perform actions as administrators, demonstrated via inserting an XSS sequence into a document. The provided documents do not specify a remediation or patch ...
SA-2008-025 - Simple access - Access bypass
The Simple Access module is a node access module that allows administrators to make some nodes private and/or editable by certain user roles. The module contains a flaw that results in the privacy information for a node being lost under certain conditions. These conditions are usually triggered v...
CVE-2008-1495
Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...
CVE-2008-1495
Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administrators to upload and execute arbitrary PHP files via a modified content type in an ajout action, as demonstrated by 1 image/gif and 2 application/pdf...
CVE-2007-6708
Multiple cross-site request forgery CSRF vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated by 1 a Restore Facto...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated by 1 a Restore Facto...
CVE-2007-6708
Multiple cross-site request forgery CSRF vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated by 1 a Restore Facto...
CVE-2008-1301
The CVE-2008-1301 entry concerns Alkacon OpenCms (versions 7.0.3 and 7.0.4). The vulnerability is an absolute path traversal in logfileViewSettings.jsp (path: system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp) that allows remote authenticated administrators to read arbitrary fi...
CVE-2007-6319
Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...
[SECURITY] Fedora 7 Update: scponly-4.6-10.fc7
scponly is an alternative 'shell' for system administrators who would like to provide access to remote users to both read and write local files without providing any remote execution priviledges. Functionally, it is best described as a wrapper to the "tried and true" ssh suite of applications...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to 1 hijack the authentication of moderators or administrators for requests that delete threads via a domultideletethreads action to moderation.php and 2 hijack the authentication of arbitra...
CVE-2008-0788
Multiple cross-site request forgery CSRF vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to 1 hijack the authentication of moderators or administrators for requests that delete threads via a domultideletethreads action to moderation.php and 2 hijack the authentication of arbitra...