691 matches found
用友某管理系统SQL注入
简要描述： 求个邀请码 来学习 详细说明： http://radm.chanjet.com http://125.35.5.144:81/fixsys/Default.aspx admin' or '1'='1 漏洞证明： admin' or '1'='1...
HackerOne: Invitation is not properly cancelled while inviting to bug reports.
This issue is a little confusing. So, if you are not able to reproduce let me know i will send you a video to help reproduce the issue. Reproduction Steps : 1 Let's say you are User A who is inviting a user B to abug report, User A goes to + signadding participants and adds a email address there....
Pie Register 2.0.14-2.0.15 - SQL Injection
User input is not validated correctly when accepting an Invitation Code, as such an SQL Injection attack is possible. This attack is triggered when the parameters ‘showdashwidget’ and ‘invitaioncode’ are provided to any page, by any user anonymous or otherwise. PoC import requests,base64,re...
Shopify: Invitation issue
Only the the store owner is allowed to create new staff members, but staff members with full access can take over other invited staff members' accounts using the invitation link that was available in Settings - Account page. To resolve this, we changed the display of the Account page so only the...
'Activate WhatsApp calling feature' Invite Scam Targeting Users with Malware
While WhatsApp is very reserved to its new calling feature, cyber scammers are targeting WhatsApp users across the world by circulating fake messages inviting users to activate the new 'WhatsApp calling feature for Android' that infects their smartphones with malicious apps. If you receive an...
HackerOne: Auto Approval of Invitation to join Team as a Team member
Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...
CVE-2014-9498
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
Cross site scripting
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
CVE-2014-9498
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
CVE-2014-9498
The Drupal Webform Invitation module (7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4) is affected by an XSS vulnerability due to insufficient sanitization of node titles. Exploitation requires an attacker to have one of the Webform-related permissions: Webform: Create new content, Webform: Edi...
X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps
It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...
[SECURITY] Fedora 20 Update: php-horde-kronolith-4.2.4-1.fc20
Kronolith is the Horde calendar application. It provides web-based calendars backed by a SQL database or a Kolab server. Supported features include Ajax and mobile interfaces, shared calendars, remote calendars, invitation management iCalendar/iTip, free/busy management, resource management,...
SA-CONTRIB-2014-116 - Webform Invitation - Cross Site Scripting (XSS)
This module enables you to create custom invitation codes for Webforms. The module failed to sanitize node titles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new content", "Webform: Edit own content" and/or "Webform: Edit any...
WePay: Unauthorized Access via Join Email Link
User A adds User B's email address and grants User B as a member of his application. This shows pending under Settings - Access. 2. User B receives an email for joining User A's application but does not act upon it yet. 3. User A changes his mind and deletes User B from his application...
AOL Instant Messenger 4.x/5.x Smiley Icon Location Remote Denial of Service Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13553/info AOL Instant Messenger is reported prone to a remote denial of service vulnerability. The issue manifests when the affected client application handles a chat invitation, a file transfer, or a game request that...
PHPBB MOD [2.0.19] Invitation Only (PassCode Bypass vulnerability)
No description provided by source. PHPBB MOD 2.0.19 Invitation Only PassCode Bypass vulnerability ------------------------------------------------------------------------------- 0 | | | | | | TM 1 | | | | | | 0 | / | ' \ / | ' \ / |/ | |/ / \ '| ' \ / \ | 1 / / | | | | / | | | | | | | / | | | | |...
phpMyBitTorrent 2.0.4 - SQL Injection Vulnerability
No description provided by source. Exploit Title: phpMyBitTorrent 2.0.4 SQL injection Google Dork: inurl:user.php?op=register Date: 14/FEB/2011 Author: [email protected] Software Link: http://sourceforge.net/projects/phpmybittorrent/ Version: 2.0.4 Tested on: nix...
Threat Outbreak Alert RuleID10296: Email Messages Distributing Malicious Software on June 11, 2014
Medium Alert ID: 34589 First Published: 2014 June 11 13:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID10296 may contain the following files: Name | Siz...
