WikyBlog Multiple Remote Input Validation Vulnerabilities

WikyBlog is prone to multiple vulnerabilities, including an arbitrary-file- upload issue, a cross-site scripting issue, a remote file-include issue and a session-fixation issue. Attackers can exploit these issues to: - execute arbitrary script code in the browser of an unsuspecting user in the...

Debian DSA-1944-1 : request-tracker3.4 request-tracker3.6 - session hijack

Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user's RT session. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

DEBIAN-CVE-2010-0289

Multiple cross-site request forgery CSRF vulnerabilities in the ACL Manager plugin plugins/acl/ajax.php in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

CVE-2010-0637

Multiple cross-site request forgery CSRF vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that 1 delete an event or 2 ban an IP address from posting via unknown vectors. NOTE: some of these...

Windows, PowerPoint Attacks Expected

Some of the bugs Microsoft patched today will be exploited by hackers almost immediately, security researchers predicted. Microsoft’s massive update — a record-tying 13 separate security bulletins that patched 26 vulnerabilities — gives attackers all kinds of ways to compromise machines and hijac...

IntelliTamper 2.072.08 - Remote Buffer Overflow (SEH)

IntelliTamper 2.072.08 - Remote Buffer Overflow SEH IntelliTamper 2.07/2.08 SEH Remote Buffer Overflow Based on PoC: http://www.exploit-db.com/exploits/11217 Author: loneferret Big thanks to: dookie Tested on WinXP SP3 English Just copy the resulting html file on a web server, and point Intelli...

Mandriva Update for roundcubemail MDVSA-2010:015 (roundcubemail)

Check for the Version of roundcubemail OpenVAS Vulnerability Test Mandriva Update for roundcubemail MDVSA-2010:015 roundcubemail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it...

Facebook Vulnerable to Clickjacking Attacks

Facebook is susceptible to certain types of attacks that could allow someone to hijack an account while a user is interacting with another Web site, a security researcher warned on Monday. Reseacher Nitesh Dhanjani also said a design flaw in Facebook is granting third-party apps permission to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI...

CVE-2009-4572

Cross-site request forgery CSRF vulnerability in PhpShop 0.8.1 allows remote attackers to hijack the authentication of arbitrary users for requests that invoke the cartAdd function in a shop/cart action to the default URI...

CVE-2009-4572

CVE-2009-4572 describes a Cross-site Request Forgery (CSRF) vulnerability in PhpShop 0.8.1 that allows remote attackers to hijack the authentication of arbitrary users by crafting requests to the cartAdd function in the shop/cart action at the default URI. The vulnerability hinges on the authenti...

CVE-2009-4563

Cross-site request forgery CSRF vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass2 parameters in a saveoptions action...

CVE-2009-4563

CVE-2009-4563 describes a CSRF vulnerability in Zenphoto 1.2.5, specifically in zp-core/admin-options.php. The issue allows remote attackers to hijack an administrator’s session and trigger password changes via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action. The connected do...

Zabbix Agent net.tcp.listen Command Injection

$Id: zabbixagentexec.rb 7854 2009-12-14 20:09:46Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...

CVE-2009-4440

Directory Proxy Server DPS in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges o...

CVE-2009-4440

Sun Java System Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition, versions 6.0–6.3.1 (Windows and other platforms per OpenVAS/NVD entries) is affected by CVE-2009-4440 due to improper handling of multiple simultaneous client connections within a short time windo...

CVE-2009-4440

Directory Proxy Server DPS in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges o...

CVE-2009-3580

Cross-site request forgery CSRF vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, newpassword, and confirmpassword parameters in a preferences action...