CVE-2012-4411

The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor. NOTE: this might be a duplicate of CVE-2007-0998...

CVE-2012-4537

Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the setp2mentry function fails, which allows local HVM guest OS administrators to cause a denial of service memory consumption and assertion failure, aka "Memory mapping failure DoS...

CVE-2012-4536

The 1 domainpirqtoemuirq and 2 physdevunmappirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service Xen crash via a crafted pirq value that triggers an out-of-bounds read...

English Defence League defaced by ZCompany Hacking Crew

ZCompany Hacking Crew members hack and deface English Defence League official website https://englishdefenceleague.org,a far-right British organization . Deface page include text "Fuck Zionist Jews! – Boycot israel! – Fuck the American Government! - Fuck fascist Organizations like EDL" and a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to the admins 2 blocks, 3 articles, or 4 suggest-category; or 5 sort parameter to the search page...

CVE-2012-5004

Multiple cross-site request forgery CSRF vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that 1 add group plans via admin/groupplans.html or 2 add extra packages via admin/extrapacks/createextrapack.html...

CVE-2012-2163

IBM Scale Out Network Attached Storage SONAS 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the 1 Command Line Interface or 2 Graphical User Interface, related to a "code injection" issue...

Server: Several CSRF security fixes

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use addBookmark.php in bookmarks/ajax/ delBookmark.php in bookmarks/ajax/ editBookmark.php in bookmarks/ajax/...

CVE-2012-2716

CVE-2012-2716 is a CSRF vulnerability in the Drupal Comment Moderation module (6.x-1.x) prior to 6.x-1.1. The issue stems from insufficient protection of the publish link URL, allowing remote attackers to perform actions as an administrative user to publish comments. Vulnerable component: Comment...

CVE-2012-1012

server/serverstubs.c in the kadmin protocol implementation in MIT Kerberos 5 aka krb5 1.10 before 1.10.1 does not properly restrict access to 1 SETSTRING and 2 GETSTRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global...

Seditio SF Quick Ban 1.0 Cross Site Request Forgery

================================================================ Vulnerable Software: SF - Quick Ban sfquickban version 1.0 is Plugin for Seditio CMS. http://www.seditioforge.com/plugins/administration/sf-quick-ban-i65.html http://www.seditioforge.com/page.php?id=65&a=dl MD5 SUM:...

Irongeek's Shared hosting MD5 Change Detection Script

Irongeek's Shared hosting MD5 Change Detection Script Adrian Crenshaw aka Irongeek just release another great tool for web admins that will monitor the files on a website, and report any changed via email. Actually "irongeek.com" was hacked few days back which is hosted on a shared hosting. There...

ContaoCMS (aka TYPOlight) 2.11 - Cross-Site Request Forgery (Delete Admin Delete Article)

ContaoCMS aka TYPOlight 2.11 - Cross-Site Request Forgery Delete Admin Delete Article +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ContaoCMS aka TYPOlight = 2.11 CSRF Delete Admin- Delete Article...

Fork CMS 3.2.5 - Multiple Vulnerabilities

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ForkCMS 3.2.5 Multiple Vulnerabilities Date : 21-02-2012 Author : Ivano Binetti http://ivanobinetti.com Software link :...

CVE-2012-1000

Multiple cross-site scripting XSS vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 message parameter to admins/login/forgot/index.php, or the 2 displayname or 3 email parameter to account/preferences.php...

CVE-2011-5011

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

Windows Gather Enumerate Domain Admin Tokens (Token Hunter)

This module enumerates Domain Admin account processes and delegation tokens. This module will first check if the session has sufficient privileges to replace process level tokens and adjust process quotas. The SeAssignPrimaryTokenPrivilege privilege will not be assigned if the session has been...

(SWAT): XSS flaw in Change Password page

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

DEBIAN-CVE-2011-2746

Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System OTRS 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors...

4 big business sites database backup leaked by Serious BLack !

4 big business sites database backup leaked by Serious BLack ! One of the Indian hacker "Serious BLack " found the SQL database backup on the 4 big business sites. These SQL dumps are hosted by Site admins on FTP that has been leaked. Sites are: =...