984 matches found
Code injection
Unspecified vulnerability in the Front-End Editor in the comcontent component in Joomla! before 1.5.15 allows remote authenticated users, with Author privileges, to replace the articles of an arbitrary user via unknown vectors...
SuSE9 Security Update : imap (YOU Patch Number 9885)
This update fixes a logical error in the challenge response authentication mechanism CRAM-MD5. Due to this mistake a remote attacker can gain access to the IMAP server as arbitrary user. CVE-2005-0198 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C...
CVE-2009-1665: Undefined Security Weakness
myaccount.php in Easy Scripts Answer and Question Script allows remote attackers to remove arbitrary user accounts via a modified userid parameter without specifying any additional fields...
Design/Logic Flaw
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...
CVE-2009-0662
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in engine/modules/imagepreview.php in Datalife Engine 6.7 allows remote attackers to hijack the authentication of arbitrary users for requests that use a modified image parameter...
MetaBBS 0.11 - Administration Settings Authentication Bypass
MetaBBS 0.11 - Administration Settings Authentication Bypass source: https://www.securityfocus.com/bid/33626/info MetaBBS is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality. Exploiting this...
Simple PHP Blog config/users.php Arbitrary User Password Hash Disclosure
The version of Simple PHP Blog installed on the remote host allows an unauthenticated, remote attacker to retrieve information about non-admin users defined to the application, including their user names and password hashes, which could in turn be used to gain access to the application. While the...
emc-sql.txt
adMERITia Vulnerability Report Vulnerability Information Vendor: EMC² Product: Centera Universal Access Version: CUA4.04735.p4 Vulnerability Type: Software Flaw Vulnerability: SQL Injection Impact: Attacker can bypass the authentication method and will be logged in as an arbitrary user. With...
Authentication flaw
BlogPHP 2.0 allows remote attackers to bypass authentication, and post 1 messages or 2 comments as an arbitrary user, via a modified blogphpusername field in a cookie...
MeltingIce File System 1.0 - Arbitrary Add User
!/usr/bin/perl use strict; use LWP::UserAgent; NOTE: user a pretty uniqe username, has the script will say successfull if a username aready existed! NOTE: exploit is mainly to get a nice quota, but it can also to be used to add a user primeraly because alot of these sites doesnt allow registratio...
BlogPHP 2.0 - index.php Multiple Cross-Site Scripting Vulnerabilities
BlogPHP 2.0 - index.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/29133/info BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue. Attackers can...
BlogPHP 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/29133/info BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue. Attackers can exploit these issues to execute arbitrary script code in the context ...
Code injection
The Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to obtain access to arbitrary user accounts, and alter or delete data, via a modified username in an unspecified cookie...
OpenInvoice 0.9 Arbitrary Change User Password Exploit
Exploit for unknown platform in category web applications ====================================================== OpenInvoice 0.9 Arbitrary Change User Password Exploit ====================================================== !/usr/bin/perl OpenInvoice 0.9 Arbitrary Change User Password Exploit...
CVE-2008-1134: Improper Authentication
OMEGA aka Omegasoft INterneSErvicesLosungen INSEL 7 supports authentication with a cookie that lacks a shared secret, which allows remote attackers to login as an arbitrary user via a modified cookie...
2WIRE Routers - 'H04_POST' Access Validation
source: https://www.securityfocus.com/bid/27516/info Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions. Unauthenticated attackers can leverage this issue to change the password of arbitrary...
Authentication flaw
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters...
CVE-2008-0391: Improper Authentication
inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account via a modified lilil parameter, in conjunction with the ubild and pa parameters...
