CVE-2014-8072

The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin...

CVE-2014-8072: Undefined Security Weakness

The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin...

CVE-2014-8073: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save User action to admin/users/user.form...

CVE-2014-8071: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the 1 givenName, 2 familyName, 3 address1, or 4 address2 parameter to registrationapp/registerPatient.page; the 5 comment parameter to...

OpenMRS 2.1 Access Bypass / XSS / CSRF

Exploit Title: OpenMRS 2.1 Standalone version Multiple Security Vulnerabilities Date: 20/10/2014 Remote: Yes Exploit Author: Mahendra Vendor Homepage: http://openmrs.org Software Link: http://sourceforge.net/projects/openmrs/files/releases/OpenMRS2.1/openmrs-2.1-standalone.zip/download Version: 2...

SAP Netweaver DoS

DoS against "Standalone Enqueue Server" service...

[SECURITY] Fedora 20 Update: thunderbird-24.7.0-1.fc20

Mozilla Thunderbird is a standalone mail and newsgroup client...

SysExporter - Grab data from list-view, tree-view, combo box, WebBrowser control, and text-box

SysExporter utility allows you to grab the data stored in standard list-views, tree-views, list boxes, combo boxes, text-boxes, and WebBrowser/HTML controls from almost any application running on your system, and export it to text, HTML or XML file. Here's some examples for data that you can expo...

AllMyGuests <= 0.4.1 (cfg_serverpath) Remote File Include Vulnerability

No description provided by source. ============================================================================ AllMyGuests = ?AMGconfigcfgserverpath Remote File Inclusion Exploit ============================================================================ Scirpt Infected signin.php Critical leve...

XCloner Standalone 3.5 - CSRF Vulnerability

No description provided by source...

Adobe Acrobat/Reader < 7.1.1/8.1.3/9.1 - Collab getIcon Universal Exploit

No description provided by source. !/usr/bin/env python Acrobat Reader - Collab getIcon universal exploiter evilpdf.py, tested on Operating Systems: Windows XP SP3 English/French Windows 2003 SP2 English with Application versions: Adobe Reader 9.0.0/8.1.2 English/French Test methods: Standalone...

Glossword 1.8.8 & 1.8.12 - Arbitrary File Upload Vulnerability

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

openSUSE Security Update : flash-player (openSUSE-SU-2011:0239-1)

The Adobe Standalone Flash Player was updated to the 10.2.153.1, fixing several bugs and one security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update flash-player-4239. The text...

PT-2014-3132

Name of the Vulnerable Software and Affected Versions openstack-foreman-installer version 4.0 Description The default configuration in the standalone controller quickstack manifest disables authentication for Qpid, allowing remote attackers to gain access by connecting to Qpid. Recommendations Fo...

foreman-installer: insecure defaults

The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, disables authentication for Qpid, which allows remote attackers to gain access by connecting to Qpid...

Сross-Site Request Forgery &#40;CSRF&#41; in XCloner Standalone

Advisory ID: HTB23207 Product: XCloner Standalone Vendor: XCloner Vulnerable Versions: 3.5 and probably prior Tested Version: 3.5 Advisory Publication: March 14, 2014 without technical details Vendor Notification: March 14, 2014 Public Disclosure: April 9, 2014 Vulnerability Type: Cross-Site...

CVE-2014-2579

Multiple cross-site request forgery CSRF vulnerabilities in XCloner Standalone 3.5 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 change the administrator password via the config task to index2.php or 2 when the enabledbbackup and sqlmem...

CVE-2014-2996

XCloner Standalone 3.5 and earlier, when enabledbbackup and sqlmem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackupcomp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses...

Code injection

XCloner Standalone 3.5 and earlier, when enabledbbackup and sqlmem are enabled, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the dbbackupcomp parameter in a generate action to index2.php. NOTE: it is not clear whether this issue crosses...

CVE-2014-2996

XCloner Standalone 3.5 and earlier are affected by CVE-2014-2996: when enable_db_backup and sql_mem are enabled, remote authenticated administrators can execute arbitrary commands via shell metacharacters in the dbbackup_comp parameter in a generate action to index2.php. The notes indicate uncert...