Сross-Site Request Forgery (CSRF) in XCloner Wordpress Plugin

High-Tech Bridge Security Research Lab discovered vulnerability in XCloner Wordpress plugin, which can be exploited to perform a CSRF attack and gain access to a backed-up copy of vulnerable website. Сross-Site Request Forgery CSRF in XCloner Wordpress Plugin: CVE-2014-2340 The vulnerability exis...

Web Accessible Backups

The remote web server is hosting web-accessible archive files that may contain backups or sensitive data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid72771; scriptversion"1.4";...

postgresql: Improper user privilege check for on-line backups

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the 1 pgstartbackup or 2 pgstopbackup functions...

DEBIAN-CVE-2013-4202

The 1 backup api/contrib/backups.py and 2 volume transfer contrib/volumetransfer.py APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an...

OpenStack: Cinder Denial of Service using XML entities

The 1 backup api/contrib/backups.py and 2 volume transfer contrib/volumetransfer.py APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack. NOTE: this issue is due to an...

MyBB < 1.6.10 Multiple Vulnerabilities

According to its version number, the MyBB install hosted on the remote web server is affected by multiple vulnerabilities : - A SQL injection vulnerability exists due to improper sanitization of user-supplied input during database optimization. - A SQL injection vulnerability exists due to improp...

phpVibe 3.1 Disclosure / Remote File Inclusion

Exploit Title: phpVibe 3.1 Multiple Vulnerability Date: 2013-05-07 Author: indoushka Software Link: http://phprevolution.com/ Category: webapps/php Version: 3.1 Price: 40€ Google dork: "Powered by phpVibe v3.1" installation Application error message :...

Add Standalone ESX(i) to Veeam

How to add a standalone VMware ESXi server to Veeam to perform backups from...

Removing Stuck VMDK From the Veeam Proxy

Challenge A virtual machine VM processed with Veeam Backup & Replication VBR has a warning that consolidation is required, but consolidation attempts fail. or A VM that VBR processed is found to have one or more orphaned snapshots a snapshot that is attached to the VM but does not show up in the...

PostgreSQL 9.1 < 9.1.9 / 9.2 < 9.2.4 Denial of Service

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.9 or 9.2.x prior to 9.2.4. As such, it is potentially affected by a denial of service vulnerability. An unprivileged user can run commands that could interfere with in-progress backups. %NASLMINLEVEL 70300 C Tenable...

Vulnerability in core server (CVE-2013-1901)

An unprivileged user can run commands that could interfere with in-progress backups...

[SECURITY] [DSA 2658-1] postgresql-9.1 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2658-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano April 04, 2013 http://www.debian.org/security/faq -...

DSA-2658-1 postgresql-9.1 - several

Bulletin has no description...

Debian Security Advisory DSA 2658-1 (postgresql-9.1 - several vulnerabilities)

Several vulnerabilities were discovered in PostgreSQL database server. CVE-2013-1899Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center discovered that it was possible for a connection request containing a database name that begins with - to be crafted that can damage or...

PostgreSQL -- anonymous remote access data corruption vulnerability

PostgreSQL project reports: The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security vulnerability in versions 9.0 and later. Al...

Fedora 17 : mediawiki-1.19.4-2.fc17 (2013-3227)

Bring mediawiki up to date to fix multiple bugs, security holes, and bring new features. The package should automatically attempt to upgrade your wiki, but please make sure to perform backups before updating. Special care may be required for MySQL based wikis. See bug 845818. Read the main...

PrestaShop E-Commerce v1.5.x->1.5.2 Multiple Vulnerabilities

This is new Multiple Vulnerabilities POC/Bugs in PrestaShop E-Commerce 1.5.x-1.5.2 The Attacker can use this bug to access and get some important information like backups/dbs, and maybe he can find some secret information like visa/paypal accounts in the backups etc... This is private exploit. Yo...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as...

Windows Flamer / Skywiper Malware Detection

Using the supplied credentials, Nessus has found evidence that the remote Windows host has been compromised by malware known as Flamer and Skywiper. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59318; scriptversion"1.6";...

CVE-2012-2905

Artiphp CMS 5.5.0 Neo r422 stores database backups with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request...