CVE-2009-4849

Multiple cross-site request forgery CSRF vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that 1 create a new user account via a save action to tvserver/user/user.do, 2 shutdown a...

CVE-2010-1732

Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...

CVE-2009-4793

Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file v...

The list of Confluence administrators is accessible via a URL

Confluence exposes a list of the administrators. This issue corrects this by removing the list and providing the user with a form that can be used to send e-mail to all the relevant administrators on the user's behalf...

The list of Confluence administrators is accessible via a URL

Confluence exposes a list of the administrators. This issue corrects this by removing the list and providing the user with a form that can be used to send e-mail to all the relevant administrators on the user's behalf...

The list of Confluence administrators is accessible via a URL

Confluence exposes a list of the administrators. This issue corrects this by removing the list and providing the user with a form that can be used to send e-mail to all the relevant administrators on the user's behalf...

Remove the download link for XML site backups

Currently Confluence allows easy download of XML site backups. This could be considered a security risk. This issue introduces a flag in the Confluencecfg.xml that allows system administrators to turn this feature on or off. By default it is off meaning that the link will not be displayed. The fl...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...

CVE-2009-4787

Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...

CVE-2009-4787

Multiple cross-site request forgery CSRF vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact...

CVE-2010-1165

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the 1 attachment aka attachments, 2 index aka indexing, or 3 backup path and then uploading a file, as exploited in the wild in April 2010...

VulnCheck KEV: CVE-2010-1165

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the 1 attachment aka attachments, 2 index aka indexing, or 3 backup path and then uploading a file, as exploited in the wild in April 2010...

Oracle Releases Critical Patch Update for Java SE and Java for Business

Oracle has released a critical patch update to address 27 vulnerabilities in Java SE and Java for Business. These vulnerabilities are in the following components: ImageIO, Java 2D, Java Runtime Environment, Java Web Start, Pack200, Sound, JSSE, and HotSpot Server. US-CERT encourages users and...

BPTutors Tutoring Site Script XSRF

Title: BPTutors Tutoring site script - CSRF Create Administrator Account Date: 26/3/2010 Author: bi0 Software: http://bpowerhouse.info/tutoring-site-script.htm Version: 1.0 Code : /\ == \ /\ \ /\ \ \ \ Admin 6+ Passwd 6+ Frist Name Last Name Email a class='classa'...

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

CVE-2009-4669

Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the loginus parameter to Login.php or 2 the Old Password field to changepwd.php, and allow 3 remote authenticated administrators to execute arbitrary SQL commands via the id...

Sql injection

Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the loginus parameter to Login.php or 2 the Old Password field to changepwd.php, and allow 3 remote authenticated administrators to execute arbitrary SQL commands via the id...

CVE-2009-4669

Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the loginus parameter to Login.php or 2 the Old Password field to changepwd.php, and allow 3 remote authenticated administrators to execute arbitrary SQL commands via the id...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that 1 delete users via the delete action in the ma2 parameter or 2 create...