PT-2015-6990

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.3 Description The issue allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role. This can be achieved by sending a post-quickdraft-save action...

Free Reprintables ArticleFR Has Multiple Cross-Site Request Forgery Vulnerabilities

Free Reprintables ArticleFR is an article directory scripting system from Free Reprintables Philippines. Free Reprintables ArticleFR 3.0.6 suffers from multiple cross-site request forgery vulnerabilities that allow remote attackers to hijack an administrator authentication request to add an...

CVE-2015-5530: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/...

PT-2015-6975

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR version 3.0.6 Description The issue allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to "dashboard/users/create/". This is due to...

Apple CUPS cupsd Privilege Escalation (CVE-2015-1158)

An elevation-of-privilege vulnerability has been reported in the Apple CUPS. The vulnerability is due to improper processing of print-job or create-job requests sent to cupsd. A remote, unauthenticated attacker can send a specially crafted localized strings to cause the 'admin/conf' and 'admin'...

[SECURITY] Fedora 22 Update: abrt-2.6.0-1.fc22

abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...

PT-2015-7579

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.85.3 Description The issue allows remote authenticated users to create super-admin accounts. This is achieved by leveraging permissions to create a user and the profiles id parameter to the "front/user.form.php"...

PT-2015-6668

Name of the Vulnerable Software and Affected Versions FiverrScript version 7.2 Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that create a new admin via a request to "administrator/admins create.php". Recommendations For...

Drupal Petition module cross-site scripting vulnerability (CNVD-2015-03892)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Petitions is one of the petition modules used in the U.S. White House website. A cross-site scripting vulnerability exists in the administration page of the Drupal Petitions module. A...

Drupal Open Graph Importer Module Limit Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP. open Graph Importer is a module that supports back-end administrators or other users to import content from other websites using open graph meta tags. A security vulnerability exists in the Drupal Open Graph Importer module...

PT-2015-5901

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniSwitch versions 6.4.5.R02 through 8.1.1.R01 Description A cross-site request forgery CSRF issue exists in the management web interface, specifically in the sec/content/sec asa users local db add.html file. This allows remote...

Open redirect

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4389: Undefined Security Weakness

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

CVE-2015-4377: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors...

PT-2015-6559

Name of the Vulnerable Software and Affected Versions Drupal Petition module versions 6.x-1.x before 6.x-1.3 Description A cross-site scripting XSS issue exists in the administration pages of the Petition module, allowing remote authenticated users with the "create petition" permission to inject...

CVE-2015-2993

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to 1 create administrator accounts via a crafted request to /createnewaccount or 2 write to arbitrary files via the fileName parameter to /userentry...

PT-2015-6037

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to create administrator accounts via a crafted request to "/createnewaccount" or write to arbitrary files via the fileName parameter to "/userentry"...

CVE-2015-4051: Improper Access Control

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...

PT-2016-4992

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue is related to an integer signedness error in the MSM V4L2 video driver. This error can be exploited by attackers to gain privileges or cause a denial of service, resulting in array overflow and...