b2ePMS 1.0 Authentication Bypass Vulnerability

No description provided by source. b2ePMS 1.0 Authentication Bypass Vulnerability Discovered by: Jean Pascal Pereira [email protected] Vendor Information: b2ePMS stands for Browser to Email Phone Message System. It is intended to replace the standard paper/carbon phone message slips commonly used...

deV!Lz Clanportal [DZCP] <= 1.34 (id) Remote SQL Injection Exploit

No description provided by source. ? errorreportingEERROR; function exploitinit if !extensionloaded'phpcurl' && !extensionloaded'curl' if !dl'curl.so' && !dl'phpcurl.dll' die oo error - cannot load curl extension!; function exploitheader echo...

Zeus Web Server 4.x Admin Interface VS_Diag.CGI Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7751/info The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks. Due to insufficient sanitization of user-supplied input, it is possible for an attacker to...

YaBB SE 1.5.x Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/9774/info It has been reported that YaBB SE may be prone to multiple vulnerabilities due to improper input validation. The issues may allow an attacker to carry out SQL injection and directory traversal attacks. Successfu...

FlexCMS 3.2.1 - Multiple CSRF Vulnerabilities

No description provided by source. +---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : FlexCMS 3.2.1 Multiple CSRF Date : 16-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com...

cPanel 5/6/7/8/9 dir Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9853/info It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to...

openemr 4 - Multiple Vulnerabilities

No description provided by source. OpenEMR 4 Level @ Smash The Stack Summary: Patient Photograph Arbitrary File Upload Initial Comment: 1. Login with valid User/Pass 2. Patient/Client - Search/New Patient search for anything 3. Click Documents - Patient Photograph 4. Upload Shell URL:...

RedCMS 0.1 register.php Multiple Field XSS

No description provided by source. source: http://www.securityfocus.com/bid/17336/info RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The application is prone to HTML-injection and...

ReBB 1.0 Image Tag Cross-Agent Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4220/info ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases. ReBB allows users t...

[SECURITY] Fedora 19 Update: mingw-curl-7.37.0-1.fc19

cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud Server before 6.0.3 allow remote attackers to hijack the authentication of users for requests that 1 conduct cross-site scripting XSS attacks, 2 modify files, or 3 rename files via unspecified vectors...

PT-2014-2666

Name of the Vulnerable Software and Affected Versions Related Posts plugin versions prior to 2.7.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that modify settings. Recommendations For versions prior to 2.7.2, update to...

PT-2014-2667

Name of the Vulnerable Software and Affected Versions Digg Digg plugin versions prior to 5.3.5 Description A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that modify settings. Recommendations For versions prior to 5.3.5, update to version 5.3...

PT-2014-2678

Name of the Vulnerable Software and Affected Versions WordPress Related Posts plugin versions prior to 2.6.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that change settings. Recommendations For versions prior to 2.6.2,...

SA-CONTRIB-2014-058 - Webserver Auth - Access Bypass

This module allows you to delegate user authentication to the web server. The module can be configured to automatically create users that have been authenticated by the web server. There was an issue where a configuration variable did not have consistent default values in the code meaning that in...

PT-2014-2617

Name of the Vulnerable Software and Affected Versions WordPress Calendar plugin versions prior to 1.3.3 Description A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that add calendar entries. Recommendations For WordPress Calendar plugin versio...

CVE-2013-4471

The Identity v3 API in OpenStack Dashboard Horizon before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user...

Code injection

lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name uid in a cookie...

PT-2014-2948

Name of the Vulnerable Software and Affected Versions SimpleRisk versions prior to 20130916-001 Description A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for requests that add projects via an add project action in the management/prioritize...

CVE-2014-1682

The CVE concerns Zabbix API authentication: versions 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 expose a user impersonation flaw in user.login. An authenticated remote user can spoof arbitrary users by supplying a crafted username, potentially enabling privilege abuse or misrepr...