164 matches found
Design/Logic Flaw
Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges...
SA-CONTRIB-2010-056 - User Queue - Cross Site Request Forgery
The User Queue module allows you to create multiple queues, add users to them, and order the users within the queue. The module is vulnerable to cross-site request forgeries CSRF via the URL used to delete users from the queue. A user with "administer user queues" permission could be manipulated...
Xataface - Admin Authentication Bypass
======================================================= Xataface Admin Auth Bypass Vulnerability ======================================================= + Discovered by : Xinapse + Site : firewire-security.com + Email : [email protected]...
Linux Kernel 2.6.x ptrace_attach Local Privilege Escalation Exploit
No description provided by source. / ptraceattach privilege escalation exploit by s0m3b0dy tested on Gentoo 2.6.29rc1 grataz: Tazo, rassta, nukedclx, maciek, D0hannuk, mivus, wacky, nejmo, filo... email: s0m3b0dy1 at gmail.com / include grp.h include stdio.h include fcntl.h include errno.h includ...
Limbo CMS 1.0.4.2 - Cross-Site Request Forgery Privilege Escalation
Limbo CMS 1.0.4.2 - Cross-Site Request Forgery Privilege Escalation Limbo cms v 1042Lt Cross-site request forgery Privilege Escalation Proof of Concept by Alfons Luja download : http://www.limboportal.com/index.php/option/downloads/task/download/id/67 d00rk: intext:"site powered by limbo"...
Serv-U7 provide the right experience Essentials-vulnerability warning-the black bar safety net
Since the author is lazy, does not provide log cleanup feature, it will leave a log: One, the su7 is the right there are several? There are two forms to get rid of su7 in. 1, login to the Administrator Console page ==get the OrganizationId for Add User ==get the global user of the“next new user I...
openSUSE 10 Security Update : NetworkManager-gnome (NetworkManager-gnome-6029)
The NetworkManager configuration was too permissive and allowed any user to read secrets CVE-2009-0365 or manipulate the configuration of other users CVE-2009-0578. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
Let you become the ASP Trojan master-vulnerability warning-the black bar safety net
Name: how to make a picture of the ASP Trojan can display pictures Built an asp file, the content of!-- of i nclude file="ating.jpg"--找 一 个 正常 图片 ating.jpg, insert the word Trojan,such as the ice Fox, with ultraedit to hex compiled, insert a picture, to run a successful, but also to search%and %...
The Gemini Portal <= 4.7 Insecure Cookie Handling Vulnerability
Exploit for unknown platform in category web applications =============================================================== The Gemini Portal eNYe-Sec - www.enye-sec.org Program description by the author website Bug Exploit Note: POST is not checked and you can enter all by GET. Also you can create...
Gentoo Security Advisory GLSA 200503-10 (Firefox)
The remote host is missing updates announced in advisory GLSA 200503-10. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Privilege escalation: User is able to add a page to his watchlist without having the permission
Szenario: create user1 and user2 user1 has access to space1 user2 has access to space2 user1 can add a page to his watchlist by manipulating using a proxy like webscarab the postrequest to http://localhost:8080/dwr/exec/PageNotification.startWatching.dwr and replacing the id contained in paramete...
FreeWebShop 2.2.1 - Blind SQL Injection
!/usr/bin/perl Indonesian Newhack Security Advisory ------------------------------------ FreeWebshop version 2.2.1 - Multiple Remote SQL Injection Vulnerabilities Waktu : Dec 16 2007 01:50AM Software : FreeWebshop version 2.2.1 Vendor : http://www.freewebshop.org/ Demo Site :...
Toko Instan 7.6 Multiple Remote SQL Injection Vulnerabilities
No description provided by source. Indonesian Newhack Security Advisory ------------------------------------ Toko Instan V7.6 - Multiple Remote SQL Injection Vulnerabilities Waktu : Nov 14 2007 08:30AM Software : Toko Instan V7.6 Vendor : http://www.tokohandal.com/ Demo Site :...
Command injection
Multiple command handlers in CA Computer Associates BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 do not verify if a peer is authenticated, which allows remote attackers to add and delete users, and start client restores...
xampp-local.txt
. //27.08.2007 16:36 .. //14.08.2007 14:21 108 .asadminpass //14.08.2007 14:21 772 .asadmintruststore //14.08.2007 18:31 .exe4j4 //26.08.2007 03:13 427 .glade2 //21.08.2007 16:35 .msf3 //10.08.2007 04:41 Contacts //27.08.2007 01:44 129 default.pls //27.08.2007 17:57 Desktop //23.08.2007 21:12 $qQ...
wolioCMS SQL Injection
wolioCMS - SQL Injection and Bypass Administrator Login Vendor : http://www.buton.web.id/member.php?member=anon Download : http://www.buton.web.id/download/woliocms.zip Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net Exploit ini berhasil jika...
Talking about virtual communities, security bug found and exploit-vulnerability warning-the black bar safety net
Author:Wang gang This article published in the hacker Handbook magazine http://www.nohack.cn that the copyright of all, reproduced please indicate the source. Personal website: www.itheroes.cn Now on the network Forum and community there are many, the Forum, the vast majority are using some free ...
MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit
No description provided by source. /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has multiple vulnerabilities with...
MiniHTTPServer Web Forum File Sharing Server 4.0 - Add User
MiniHTTPServer Web Forum File Sharing Server 4.0 - Add User /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has...
vulnerabilities: CVE-2006-{3113,3677,3801-3812}
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to reference remote files and possibly load chrome: URLs by tricking the user into copying or dragging links...