EUVD-2008-0585

Malware in sbrugna...

Code injection

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image...

up.time 7.5.0 Superadmin Privilege Escalation

up.time 7.5.0 Superadmin Privilege Escalation Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: up.time suffers from a privilege escalation issue. Normal user...

CVE-2008-0575

Cross-site request forgery CSRF vulnerability in admin/admincenter.php in webSPELL 4.01.02 allows remote attackers to assign the superadmin privilege level to arbitrary accounts as administrators via an "update member" action...