Zenphoto CMS 1.3 - Multiple CSRF Vulnerabilities

No description provided by source. !--- Title: Zenphoto CMS 1.3 Multiple CSRF Vulnerabilities Author: 10n1z3d 10n1z3datwdotcn Date: Wed 14 Jul 2010 12:48:56 PM EEST Vendor: http://www.zenphoto.org/ Download: http://zenphoto.googlecode.com/files/zenphoto-1.3.tar.gz --- -= CSRF PoC 1 - Change Admin...

FTP Drive + HTTP 1.0.4 iOS - Code Execution Vulnerability

No description provided by source. Document Title: =============== FTP Drive + HTTP 1.0.4 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1231 Release Date: ============= 2014-03-20 Vulnerability Laboratory ID VL-ID:...

eclime 1.1 - Bypass / Create and Download Backup Vulnerability

No description provided by source...

oscommerce <= 2.2rc2a Bypass/Create and Download Backup Vulnerability

No description provided by source. ======================================================================================== $ | Title : osCommerce online SHop Backup Vulnerability $ | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

Store Locator Remote Add Admin Exploit CSRF Vulnerability

No description provided by source. vendor: www.ghostscripter.com ::::::::::::::explo!t::::::: ::::::: html head title Store Locator Remote Add Admin Exploit /title /head body text=00FF00 bgcolor=000000 form action=http://server/StoreLocator/adm/adminadd.php method=post style=text-align: center br...

Wordpress Spicy Blogroll Plugin - File Inclusion Vulnerability

No description provided by source. ?php // Title: Wordpress Plugin Spicy Blogroll File Inclusion Vulnerability // Date: 12-07-2013 GMT+8 Kuala Lumpur // Author: Ahlspiess // Greetz: All TBDIAN - http://w3.tbd.my : // Screenshot: http://i.imgur.com/jIrUznC.png / Details: File:...

Oracle <= 9i / 10g (extproc) - Local/Remote Command Execution Exploit

No description provided by source. -- -- $Id: raptororaextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $ -- -- raptororaextproc.sql - command exec via oracle extproc -- Copyright c 2006 Marco Ivaldi [email protected] -- -- Directory traversal vulnerability in extproc in Oracle 9i and 10g --...

Mozilla: Use-after-free and out of bounds issues found using Address Sanitizer (MFSA 2014-49)

Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via unspecified vectors...

Cannot create page/s using "Create Page" Button

We are a large corporation currently in the process of rolling out a complete Atlassian Toolchain Jira, Confluence, Bamboo, Stash within the next 4 weeks. Unfortunately in Confluence, we cannot use the "Create Page" Button, as we get the following issue regardless of when this is done or by whom:...

Simple SQLi Dumper v5.1 - Tool to find bugs, errors or vulnerabilities in MySQL database

SSDp is an usefull penetration tool to find bugs, errors or vulnerabilities in MySQL database. Functions SQL Injection Operation System Function Dump Database Extract Database Schema Search Columns Name Read File read only Create File read only Brute Table & Column Download Simple SQLi Dumper v5....

PT-2014-3188

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.5, 9.7 before FP9a, 10.1 before FP3a, 10.5 before FP3a Description The issue allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE EXTERNAL ROUTINE authority in the Stored...

PT-2014-2625

Name of the Vulnerable Software and Affected Versions KrisonAV CMS versions prior to 3.0.2 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request. Recommendations For versio...

CVE-2013-2713: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in usersmaint.html in KrisonAV CMS before 3.0.2 allows remote attackers to hijack the authentication of administrators for requests that create user accounts via a crafted request...

CVE-2013-4320

The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL...

PT-2014-2613

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions prior to 1.8.5 Description A cross-site request forgery CSRF issue exists in the Admin web interface, allowing remote attackers to hijack the authentication of administrators for requests that create administrati...

CVE-2013-2692: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users...

Important: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat CloudForms 3.0. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, whi...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vecto...

CVE-2014-0056

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command...

CVE-2014-0056: Improper Authentication

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command...