Moab User Impersonation [CVE-2014-5375]

Moab User Impersonation : CVE-2014-5375 Software: Moab Affected Versions: All current versions of Moab. However, the impact is limited in Moab 7.2.9 and Moab 8. CVE Reference: CVE-2014-5375 Author: John Fitzpatrick, Luke Jennings MWR Labs http://labs.mwrinfosecurity.com/ Severity: High Risk Vendo...

YiDacms 最新版重置任意用户账户二及其他越权操作

简要描述： YiDacms 最新版重置任意用户账户，及其他越权操作 详细说明： 易达CMS 企业建站系统 当前最新版本是：YidaCms X3.2（20140718）版 之前发过一次重置任意用户密码的漏洞，但是只能修改成固定的密码，要是修改成任意密码的话，比较麻烦，需要md5明文密码后取10位作为信息密码，较麻烦。 这里我们直接输入任意明文密码，即可修改 来看看源代码： 文件/Yidacms/user/user.asp if request"yidacms"="password" Then set rs=server.createobject"adodb.recordset" useri...

Messagerie 1.0 Arbitrary User Removal DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4635/info Messagerie is a web message board application maintained by La Basse. An issue has been discovered in Messagerie, which could allow an attacker to delete arbitrary user accounts. Reportedly, submitting a special...

Vanilla Forums 2-0-18-4 - SQL-Injection Vulnerability

Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on:...

BirthSys 3.1 - Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/16684/info BirthSys is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitatio...

Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit

No description provided by source. !/usr/bin/perl use strict; use LWP::UserAgent; print -+- Pet Grooming Management System = 2.0 Arbitrary Add-Admin Exploit -+-\n; print -+- Discovered && Coded By: t0pP8uZz - Discovered On: 15 MAY 2008 -+-\n; print -+- Script Download:...

WordPress iMember360 Plugin <= 3.9.001 - Arbitrary user deletion

Because of this vulnerability, the attackers can delete arbitrary users via a request containing a user name in the "Email" parameter and the API key in the "i4wclearuser" parameter. Solution Update the plugin...

U-Mail邮件系统获取指定账户权限（任意用户明文密码查询）

简要描述： 可获取该系统指定用户权限，最近看发这套的人挺多的，不知道我这个你们觉得鸡肋不 详细说明： u-mail取回密码处设计不当，导致任意用户密码可越权查看，当update=s时，可查看任意账户密码 http://mail.xxx.com/webmail/[email protected]&update=s 直接查看指定邮箱账户密码 接下来想做什么都可以了。 谷歌: Powered by U-Mail 邮件服务器 官网Demo：...

CVE-2014-1347

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

Code injection

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations...

CVE-2013-4552

lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name uid in a cookie...

CVE-2014-1841

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. dot dot in the src parameter...

Wordpress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities

Exploit for php platform in category web applications ------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal WordPress site into a full featured membership site. It includes all the protection controls you can imagine, yet driven by Infusionsoft's...

WordPress Plugin iMember360 3.8.012 < 3.9.001 - Multiple Vulnerabilities

------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal WordPress site into a full featured membership site. It includes all the protection controls you can imagine, yet driven by Infusionsoft's second-to-none CRM and e-commerce engine." --...

WordPress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities

WordPress iMember360 plugin is prone to multiple vulnerabilities, such as XSS, arbitrary user deletion, arbitrary code execution and disclosure of database credentials vulnerabilities. Solution Upgrade the plugin...

WordPress Plugin iMember360 3.8.012 3.9.001 - Multiple Vulnerabilities

WordPress Plugin iMember360 3.8.012 3.9.001 - Multiple Vulnerabilities ------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal WordPress site into a full featured membership site. It includes all the protection controls you can imagine, yet driven by...

WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution

------------ BACKGROUND ------------ "iMember360is a WordPress plugin that will turn a normal WordPress site into a full featured membership site. It includes all the protection controls you can imagine, yet driven by Infusionsoft's second-to-none CRM and e-commerce engine." --...

iMember360 < 3.9.001 - Multiple Issues

- Disclosure of database credentials - XSS Vulnerabilities - Arbitrary user deletion - Arbitrary code execution...

CVE-2014-2034

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."...

Path traversal

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."...