CRE Loaded Multiple Security Bypass Vulnerabilities

CRE Loaded is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

Authentication flaw

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

CVE-2009-5077

CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHPSELF variable, which is not properly handled by 1 includes/applicationtop.php and 2 admin/includes/applicationtop.php...

CVE-2009-5077

CRE Loaded before 6.2.14 is vulnerable to an authentication bypass that can grant administrator privileges via manipulation of a modified PHP_SELF variable, not properly handled by includes/application_top.php and admin/includes/application_top.php. The issue affects CRE Loaded prior to version 6...

CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

Authentication flaw

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is not properl...

CVE-2009-5076

CVE-2009-5076 affects CRE Loaded prior to 6.3.x (and possibly other versions before 6.3.x) where authentication can be bypassed via PATH_INFO by requesting login.php or password_forgotten.php, exploiting improper handling of PHP_SELF in includes/application_top.php and admin/includes/application_...

PT-2011-1330 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions prior to 6.3.x CRE Loaded version 6.2.14 and earlier Description: The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by sending a request with specific PHP files,...

VulnCheck KEV: CVE-2009-5076

CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with 1 login.php or 2 passwordforgotten.php appended as the PATHINFO, which bypasses a check that uses PHPSELF, which is...

PT-2011-1331 · Cre Loaded · Cre Loaded

Name of the Vulnerable Software and Affected Versions: CRE Loaded versions prior to 6.2.14 Description: The issue allows remote attackers to bypass authentication and gain administrator privileges. This is related to a modified PHP SELF variable, which is not properly handled by includes in the...

Microsoft Windows Explorer 6.0.2900.5512 - 'Shmedia.dll 6.0.2900.5512' AVI Preview Denial of Service (PoC)

done by BraniX www.hackers.org.pl found: 2011.03.27 published: 2011.03.29 tested on: Windows XP SP3 Home Edition tested on: Windows XP SP3 Professional Edition App: Windows Explorer 6.0.2900.5512 Shmedia.dll 6.0.2900.5512 App Url: http://www.micro$oft.com Shmedia.dll 6.0.2900.5512 MD5:...

Kolibri v2.0 Buffer Overflow RET + SEH exploit (HEAD)

Exploit for windows platform in category remote exploits !/usr/bin/env python / / / / / // | / // \ | / / / / / /// / / / / / / / // / / / |/ / // / , / / // / / / / / //// //|///||/,/ / /// Live by the byte |// Members: Pr0T3cT10n -=M.o.B.=- TheLeader gsog2009 a7 homtail d0t com Sro Debug...

CRE Loaded version 6.2 osCommerce by Pass Creat and Download Backup

Exploit for php platform in category web applications ======================================================================== CRE Loaded version = 6.2 osCommerce by Pass / Creat and Download Backup ========================================================================...

mikmod: crash or abort when loading/playing multiple files with different number of channels

libmikmod 3.1.9 through 3.2.0, as used by MikMod, SDL-mixer, and possibly other products, relies on the channel count of the last loaded song, rather than the currently playing song, for certain playback calculations, which allows user-assisted attackers to cause a denial of service application...

CompactCMS 1.4.0 Remote File Upload

dear sir or madam ITSecTeam has found new vulnerability in CompactCMS 1.4.0 tinymce In the following contain some information about the bug best regards [email protected] Technical Manager Title: CompactCMS 1.4.0 tinymce Remote File Upload Vendor: http://www.compactcms.nl/ AUTHOR: ITSecTeam Email:...

CompactCMS 1.4.0 - 'tiny_mce' Arbitrary File Upload

Title: CompactCMS 1.4.0 tinymce Remote File Upload Vendor: http://www.compactcms.nl/ AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability52.htm Thanks: r3dm0v3, pejvak,...

Cross site scripting

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next...