868 matches found
CVE-2012-0792
mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts...
HDWiki 5.1 arbitrary User Password Change vulnerability and fix-vulnerability warning-the black bar safety net
HDWiki reset the password there is a logical vulnerability, the attacker can modify any user password. Detailed description: control/user.php function dogetpass ...... elseifisset$this-post'verifystring' $uid=$this-post'uid'; $encryptstring=$this-post'verifystring';...
HDWiki 5.1 任意用户密码修改漏洞
简要描述： HDWiki重置密码存在一处逻辑漏洞，导致攻击者可以修改任意用户密码。 详细说明： control/user.php function dogetpass ...... elseifisset$this-post'verifystring' $uid=$this-post'uid'; $encryptstring=$this-post'verifystring'; $idstring=$ENV'user'-getidstringbyuid$uid,$this-time; if$idstring==$encryptstring //没考虑到提交为空与查询返回为空的情况，一个逻辑...
Authentication flaw
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, ak...
Authentication flaw
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."...
Cross-site Request Forgery (CSRF) Vulnerabilities in Pragyan CMS
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Pragyan CMS which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF vulnerabilities in Pragyan CMS 1.1 The vulnerability exists due to insufficient validation of...
CVE-2011-0910
The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...
Code injection
The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...
CVE-2010-3435
The 1 pamenv and 2 pammail modules in Linux-PAM aka pam before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a...
PT-2010-5338 · Red Hat · Condor +1
Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Messaging, Realtime and Grid MRG version 1.3 Description: The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid MRG recommends a configuration that creates a trusted channel with insufficient...
CVE-2009-4133
Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users to queue jobs as an arbitrary user, and thereby gain privileges, by using a Condor command-line tool to modify an unspecified job attribute...
Code injection
Unspecified vulnerability in the Front-End Editor in the comcontent component in Joomla! before 1.5.15 allows remote authenticated users, with Author privileges, to replace the articles of an arbitrary user via unknown vectors...
SuSE9 Security Update : imap (YOU Patch Number 9885)
This update fixes a logical error in the challenge response authentication mechanism CRAM-MD5. Due to this mistake a remote attacker can gain access to the IMAP server as arbitrary user. CVE-2005-0198 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...
Design/Logic Flaw
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...
CVE-2009-0662
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter...
MetaBBS 0.11 - Administration Settings Authentication Bypass
MetaBBS 0.11 - Administration Settings Authentication Bypass source: https://www.securityfocus.com/bid/33626/info MetaBBS is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality. Exploiting this...
Simple PHP Blog config/users.php Arbitrary User Password Hash Disclosure
The version of Simple PHP Blog installed on the remote host allows an unauthenticated, remote attacker to retrieve information about non-admin users defined to the application, including their user names and password hashes, which could in turn be used to gain access to the application. While the...
emc-sql.txt
adMERITia Vulnerability Report Vulnerability Information Vendor: EMC² Product: Centera Universal Access Version: CUA4.04735.p4 Vulnerability Type: Software Flaw Vulnerability: SQL Injection Impact: Attacker can bypass the authentication method and will be logged in as an arbitrary user. With...