CVE-2013-3315

The server in TIBCO Silver Mobile 1.1.0 does not properly verify access to the administrator role before executing a command, which allows authenticated users to gain privileges via unspecified vectors...

CVE-2013-3315

CVE-2013-3315 affects TIBCO Silver Mobile 1.1.0 server. Root cause: the server fails to properly enforce administrator privileges before executing commands, enabling authenticated users to gain privileges via unspecified vectors. Impact is privilege escalation that could lead to arbitrary command...

WordPress User Role Editor 3.12 Cross Site Request Forgery

WordPress User Role Editor plugin version 3.12 suffers from a cross site request forgery vulnerability Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-edito...

SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS)

The Webform module allows the creation of custom webforms and surveys. Webform module does not sanitize the labels of created components fields when displaying a list of components to be used in e-mails or downloaded CSV files. This vulnerability is mitigated by the fact that an attacker must hav...

WordPress User Role Editor 3.12 Cross Site Request Forgery

Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software Link:https://wordpress.org/support/plugin/user-role-editor Version: =3.12 Tested on: Debian...

Wordpress User Role Editor Plugin 3.12 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software...

WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery

WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software...

WordPress User Role Editor Plugin 3.12 - CSRF

User Role Editor plugin is prone to a cross site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Update the plugin...

WordPress Plugin User Role Editor 3.12 - Cross-Site Request Forgery

Exploit Title: WP User Role Editor CSRF Date: 19/5/13 Exploit Author: Henry Hoggard Author Website: http://henryhoggard.co.uk Vendor Homepage:https://wordpress.org/support/plugin/user-role-editor Software Link:https://wordpress.org/support/plugin/user-role-editor Version: =3.12 Tested on: Debian...

CVE-2013-2079

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

CVE-2013-2079

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

Code injection

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

CVE-2013-2079

The CVE-2013-2079 issue affects Moodle’s assignment module (Moodle versions 2.3.x before 2.3.7 and 2.4.x before 2.4.4). The vulnerability arises because mod/assign/locallib.php does not enforce capability requirements when processing ZIP assignment-archive download (downloadall) requests, allowin...

Puppet Unsafe YAML Unserialization

According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability. Specially crafted YAML encoded objects are not unserialized safely. A remote, unauthenticated attacker could exploit this to execute arbitrary code. The issue is...

SA-CONTRIB-2013-043 - MP3 Player - Cross Site Scripting (XSS)

This module enables you to easily enable a Flash MP3 Player on a CCK FileField. The module doesn't sufficiently filter user-supplied text from mp3 filenames. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create a node with an mp3 filefield wi...

Winnti Cyberespionage Campaign Targets Gaming Companies

A cybercrime gang has been running roughshod over the gaming industry for years using malware signed with valid digital certificates to steal source code and valuable in-game currency for a number of popular online games. Researchers at Kaspersky Lab this morning published a report on the Winnti...

Novell Identity Manager Role Based Provisioning Module Detection

The web interface for Novell Identity Manager Role Based Provisioning Module was detected on the remote host. Novell Identity Manager is an enterprise identity management solution. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid65916; scriptversion"1.4";...

Novell Identity Manager Role Based Provisioning Module Unspecified Vulnerability

The remote web server has an install of Novell Identity Manager Role Based Provisioning Module that is affected by an unspecified vulnerability in its login functionality. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2013-1829

calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role...

Ubuntu: Security Advisory (USN-1745-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...