CVE-2012-1000

Multiple cross-site scripting XSS vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 message parameter to admins/login/forgot/index.php, or the 2 displayname or 3 email parameter to account/preferences.php...

CVE-2011-5011

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

Windows Gather Enumerate Domain Admin Tokens (Token Hunter)

This module enumerates Domain Admin account processes and delegation tokens. This module will first check if the session has sufficient privileges to replace process level tokens and adjust process quotas. The SeAssignPrimaryTokenPrivilege privilege will not be assigned if the session has been...

(SWAT): XSS flaw in Change Password page

Cross-site scripting XSS vulnerability in the chgpasswd function in web/swat.c in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program aka the user field...

DEBIAN-CVE-2011-2746

Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System OTRS 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors...

4 big business sites database backup leaked by Serious BLack !

4 big business sites database backup leaked by Serious BLack ! One of the Indian hacker "Serious BLack " found the SQL database backup on the 4 big business sites. These SQL dumps are hosted by Site admins on FTP that has been leaked. Sites are: =...

As a developer or release manager I want to be able to create and manage versions in JIRA without having to be given project admin permissions

Currently JIRA only allows a user to create, release and generally manage versions in a project if the user is a project admin. However there are numerous use cases where developers, release managers, project managers, etc. need to be able to perform this function but don't need full admin rights...

[SECURITY] CVE-2010-3449: Apache Continuum CSRF vulnerability

CVE-2010-3449: Apache Continuum CSRF vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Continuum 1.3.6 Continuum 1.4.0 Beta The unsupported versions Continuum 1.1 - 1.2.3.1 are also affected. Description: Administrators are able to change any user's...

Albania Security Group Hack more than 1000 Facebook Pages In One day !

Albania Security Group Hack more than 1000 Facebook Pages In One day ! There are Four Admins In the Group : 1. Hacker Twilight 2. Akrepi Hacker 3. BombRun 4. WarBot They Spread a Hex Javascript on Facebook, Once Victim will run that ,it automatically add there email id as admin in all victims...

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting

Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins or an...

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting

LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting Exploit Title: lifetype 1.2.10 http referer XSS Date: 11-1-2010 Author: Saif El-Sherei Software Link: http://lifetype.net/page/downloads Version: 1.2.10 Tested on: firefox 3.0.15 failure to sanitize the http referer header in index.ph...

Samyak Tejawat found vulnerability in this Italian government site !

Samyak Tejawat 13 year old found vulnerability in this Italian government site ! Whole database can be extracted. Mr. Samyak Tejawat inform the admins of site about this venerability, Hope it will be fixed soon : SQLi vuln. link =...

Admin menu items displayed to non-admins when accessing "Global Templates" page

When accessing the "Global Templates" menu as a non-admin, the navigation controls for the administration panel are displayed. The links cannot be used without entering new credentials, but it would be more consistent to hide the links from non-admins, just as we hide "System Administrator" links...

Admin menu items displayed to non-admins when accessing "Global Templates" page

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-21562. panel When accessing the "Global Templates" menu as a non-admin, the navigation controls for the administration panel are...

STUXNET Scanner to Identify Stuxnet Infected Machines !

TrendLabs has created a STUXNET Scanner Tool to help administrators with clues to determine which computers in their networks are still infected by STUXNET. This tool helps administrators identify infected machines within their own networks even if STUXNET is not communicating as STUXNET installs...

Design/Logic Flaw

/usr/local/cm/bin/pktCapprotectData in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and...

VWD-CMS - Cross-Site Request Forgery

VWD-CMS - Cross-Site Request Forgery ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | Wellcome to My...

Month Of Abysssec Undisclosed Bugs - Eshtery CMS

''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub12-eshtery-cms-sql-injection-vulnerability/ ''' Abysssec Inc Public Advisory Title : eshtery CMS Sql Injection Vulnerability Affected Version :...

eshtery CMS - SQL Injection

eshtery CMS - SQL Injection ''' | / |/ \ /\ | | | | \ | \ / | | | | / \ | | | | | | | |/| | | | |/ /\ | | | | | | | | || / \ || | | | || ||// \/|/ http://www.exploit-db.com/moaub12-eshtery-cms-sql-injection-vulnerability/ ''' Abysssec Inc Public Advisory Title : eshtery CMS Sql Injection...

eshtery CMS SQL Injection Vulnerability

Exploit for asp platform in category web applications ======================================= eshtery CMS SQL Injection Vulnerability ======================================= Title : eshtery CMS Sql Injection Vulnerability Affected Version : eshtery copyrights 2003-2004 Discovery : www.abysssec.co...