Manage Engine Service Desk Plus 7.6 - woID SQL Injection

No description provided by source...

TotalCalendar 2.4 - Remote Password Change Exploit

No description provided by source. title Powered by: TotalCalendar 2.4 Remote Password Change /title tr align=left td width=10 /td td align=centerspan class=boxHeaderCod3d By ThE g0bL!N/span/td td width=10 align=right/td /tr /table/span/td /tr /table /td /tr tr td style=padding: 0px; table...

DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties

No description provided by source. DirectControlTM Version 3.1.7.0 - Multiple Vulnerabilties ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script...

Windows Autologin Password Dumper & Manager v2.0

Windows Autologin Password is the free command-line tool to quickly dump and manage the Windows Automatic Logon Password. Automatic Logon is one of the useful feature in Windows which allows you to login to system automatically without entering the password everytime. This tool helps you to easil...

CVE-2014-3416

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet...

Code injection

uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet...

CVE-2014-3416

CVE-2014-3416 affects uPortal prior to 4.0.13.1. The vulnerability arises from an improper check of MANAGE permissions, enabling remote authenticated users to manage arbitrary portlets by abusing the portlet-admin portlet’s SUBSCRIBE permission. The impact is the potential modification/management...

CVE-2014-3783

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

CVE-2014-3123

Cross-site scripting XSS vulnerability in admin/manage-images.php in the NextCellent Gallery plugin before 1.19.18 for WordPress allows remote authenticated users with the NextGEN Upload images, NextGEN Manage gallery, or NextGEN Manage others gallery permission to inject arbitrary web script or...

WordPress NextCellent Gallery Plugin <= 1.19.17 - XSS

Because of this vulnerability in admin/manage-images.php, authenticated users can inject arbitrary web script or HTML via the "Alt & Title Text" field. Solution Update the plugin...

CVE-2014-2042

Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory ...

CVE-2014-2042

Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory ...

CVE-2014-2042

CVE-2014-2042 affects Livetecs Timelive; unrestricted file upload in the Manage Project functionality (Uploads/) enables remote code execution. Affected: Timelive up to version 6.2.71. Root cause: lack of file-type restrictions and permissive Read/Execute on uploaded files. Impact: potential arbi...

CVE-2014-2042

Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory ...

CVE-2014-2325

Multiple cross-site scripting XSS vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the 1 state parameter to objects/who/index.htm or 2 User email address to quarantine/spam/manage.htm...

CVE-2013-3943

Cross-site scripting XSS vulnerability in DotNetNuke DNN before 6.2.9 and 7.x before 7.1.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the Display Name field in the Manage Profile...

[SECURITY] Fedora 20 Update: openstack-nova-2013.2.1-4.fc20

OpenStack Compute codename Nova is open source software designed to provision and manage large networks of virtual machines, creating a redundant and scalable cloud computing platform. It gives you the software, control panels, and APIs required to orchestrate a cloud, including running instances...

CVE-2013-5897

Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Manage Data Cache...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Manage Data Cache...

CVE-2013-5897

Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Manage Data Cache...