Cross site request forgery (csrf)

Gadu-Gadu does not properly perform protocol handling, which allows remote attackers to conduct cross-site request forgery CSRF attacks and add arbitrary user accounts or cause a denial of service as administrators via an unspecified "crafted link," possibly related to the gg protocol...

CVE-2007-3275

MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...

CVE-2007-3275

MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...

Mltiple MIT Kerberos security vulnerabilities

telnet daemon arbitrary user logon without password, krb5klogsyslog buffer overflow, double free vulnerability...

MITKRB5-SA-2007-001: telnetd allows login as arbitrary user [CVE-2007-0956]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MIT krb5 Security Advisory 2007-001 Original release: 2007-04-03 Last update: 2007-04-03 Topic: telnetd allows login as arbitrary user Severity: CRITICAL CVE: CVE-2007-0956 CERT: VU220816 SUMMARY ======= The MIT krb5 telnet daemon telnetd allows...

MIT Kerberos 5 telnet daemon allows login as arbitrary user

Overview A vulnerability exists in the version of the telnet daemon included with the MIT Kerberos 5 distribution that may allow a remote, unauthorized attacker to log on to the system with elevated privileges. Description A vulnerability exists version of the telnet daemon included with the MIT...

CVE-2006-4580: Undefined Security Weakness

register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary users by setting the mode parameter to "confirm"...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5476

Cross-site request forgery CSRF vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors...

CVE-2006-5474

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...

NeoSys Neon Webmail for Java 5.065.07 - updateuser?in_id Servlet Arbitrary User Information Modification

NeoSys Neon Webmail for Java 5.065.07 - updateuser?inid Servlet Arbitrary User Information Modification source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: -...

NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_id' Servlet Arbitrary User Information Modification

source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service resource consumption via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations...

PT-2006-5082 · Jelsoft · Vbulletin

Name of the Vulnerable Software and Affected Versions: Jelsoft vBulletin version 3.5.4 Description: The issue allows remote attackers to register multiple arbitrary users, potentially causing a denial of service due to resource consumption. This can be achieved by sending a large number of reques...

CVE-2006-3414: Undefined Security Weakness

Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution...

DELTAScripts PHP Classifieds 6.20 - 'Member_Login.php' SQL Injection

source: https://www.securityfocus.com/bid/16642/info PHP Classifieds is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromis...

DELTAScripts PHP Classifieds 6.20 - Member_Login.php SQL Injection

DELTAScripts PHP Classifieds 6.20 - MemberLogin.php SQL Injection source: https://www.securityfocus.com/bid/16642/info PHP Classifieds is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL...

CVE-2005-1654: Direct Request

Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set...

SUSE-SA:2005:012: imap

The remote host is missing the patch for the advisory SUSE-SA:2005:012 imap. The University of Washington imap daemon can be used to access mails remotely using the IMAP protocol. This update fixes a logical error in the challenge response authentication mechanism CRAM-MD5 used by UW IMAP. Due to...

CVE-2005-0002: Undefined Security Weakness

poppassdpam 1.0 and earlier, when changing a user password, does not verify that the user entered the old password correctly, which allows remote attackers to change passwords for arbitrary users...