58 matches found
Concrete CMS: 'cnvID' parameter vulnerable to Insecure Direct Object References
Installation Information === IIS 8, PHP 5.5, Concrete5 5.7.5.7 Default install Issue POC An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers. 1. An example blog with permission...
Rockstar Games: Ability to post comments to a crew even after getting kicked out
The researcher found that under certain conditions, Crew members were still able to perform particular actions, such as posting on the Crew wall, even after being kicked from the Crew. Additional verification checks were put in place to prevent this behavior. TL;DR - Members who got kicked out of...
CVE-2015-2213
SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...
PHPJabbers Post Comments 3.0 Cookie Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/31467/info PHPJabbers Post Comments is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication. An attacker can exploit this...
CVE-2012-2082
Cross-site scripting XSS vulnerability in the Chaos tool suite aka CTools module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature...
Cross site scripting
Cross-site scripting XSS vulnerability in the Chaos tool suite aka CTools module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature...
CVE-2010-3457
Multiple cross-site scripting XSS vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 fieldswebsite parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or 2 send-emailrecipient parameter to...
CVE-2010-3457
Multiple cross-site scripting XSS vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 fieldswebsite parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or 2 send-emailrecipient parameter to...
PHPJabbers Post Comments 3.0 - Cookie Authentication Bypass
PHPJabbers Post Comments 3.0 - Cookie Authentication Bypass source: https://www.securityfocus.com/bid/31467/info PHPJabbers Post Comments is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication. An attacker...
PHPJabbers Post Comments 3.0 - Cookie Authentication Bypass
source: https://www.securityfocus.com/bid/31467/info PHPJabbers Post Comments is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication. An attacker can exploit this vulnerability to gain administrative access...
Post Comments 3.0 Insecure Cookie Handling Vulnerability
No description provided by source. Post Comments v3.0 Insecure Cookie Handling Vulnerability By CrackersChild Demo : http://www.phpjabbers.com/post-comment/try/admin.php Vendor : by phpjabbers.com Exploit : javascript:document.cookie = "PostCommentsAdmin=logged; path=/"; Tum Musluman Aleminin...
Post Comments 3.0 - Insecure Cookie Handling
Post Comments 3.0 - Insecure Cookie Handling Post Comments v3.0 Insecure Cookie Handling Vulnerability By CrackersChild Demo : http://www.phpjabbers.com/post-comment/try/admin.php Vendor : by phpjabbers.com Exploit : javascript:document.cookie = "PostCommentsAdmin=logged; path=/"; Tum Musluman...
postcomments-cookie.txt
Post Comments v3.0 Insecure Cookie Handling Vulnerability By CrackersChild Demo : http://www.phpjabbers.com/post-comment/try/admin.php Vendor : by phpjabbers.com Exploit : javascript:document.cookie = "PostCommentsAdmin=logged; path=/"; Tum Musluman Aleminin Ramazan Bayrami Kutlu Olsun...
Post Comments 3.0 Insecure Cookie Handling Vulnerability
Exploit for unknown platform in category web applications ======================================================== Post Comments 3.0 Insecure Cookie Handling Vulnerability ======================================================== Post Comments v3.0 Insecure Cookie Handling Vulnerability By...
Authentication flaw
BlogPHP 2.0 allows remote attackers to bypass authentication, and post 1 messages or 2 comments as an arbitrary user, via a modified blogphpusername field in a cookie...
CVE-2007-5621
Multiple cross-site scripting XSS vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a...
CVE-2007-5621
Multiple cross-site scripting XSS vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a...
Unfixed XSS vulnerability at www.lovelyparty.co.uk
Security researcher x2Fusion, has submitted on 02/09/2007 a cross-site-scripting XSS vulnerability affecting www.lovelyparty.co.uk, which at the time of submission ranked 6115330 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2007. It is...