179 matches found
Tejari Cross Site Request Forgery
----------------------------------------------------- Vulnerability Type: Cross Site Request Forgery CSRF Vendor of Product: Tejari Affected Product Code Base: Bravo Solution Affected Component: Web Interface Management. Attack Type: Local - Authenticated Impact: Unauthorised Access...
CVE-2017-6513
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL...
How to Verify Active Users or ICA Users on Citrix Gateway
This article describes how to verify Active Users or ICA User on Citrix Gateway...
VK.com: Второй способ обхода 2FA
Недостаточная проверка пользователя при смене IP-адреса. Лазейка с релогином при смене IP у пользователя...
Slack: [Screenhero] Subdomain takeover
Hi, I found out some neglected DNS records that can be exploited to takedown the subdomain of Slack's acquisition feedback.screenhero.com The security issue is that you have CNAME record that points feedback.screenhero.com to a screenhero.uservoice.com, but the problem is that the service is...
Mango Automation 2.6.0 User Enumeration
Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to...
Enter: GA code not verified on the server side allows sending Verification Documents on behalf of another user
Host api.romit.io Endpoint /v0/cash/auth/login/verify Issue The GA Code is not verified on the server side for the users whose "Verification application" has been DENIED by the Romit support Team PoC 1. Setup an account at app.romit.io, use your apiKey, apiSecret and Location-ID to setup. 2. Now...
金蝶销管家逻辑缺陷重置任意用户密码(工作人员账户测试/秒改)
简要描述： 可绕过验证码直接修改用户密码。 详细说明： 0x1:先信息收集一些工作人员的账户用来测试，来证明漏洞的危害性。 13580111111 13752248075 13456231475 13456879564 15578945623 13456231245 13456231245 13648776985 13400002111 13625668852 15018517663 15915533696 13888888888 13456789123 18090700000 13165454756 13654213923 13654213923 13760368754...
DEBIAN-CVE-2013-6404
Quassel core server daemon in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in 1 16/selectbufferbyid.sql, 2 16/selectbufferbyid.sql, and 3 16/selectbufferbyid.sql i...
Apache mod_suexec Multiple Privilege Escalation Vulnerabilities
The remote host appears to be running Apache and is potentially affected by the following vulnerabilities: - Multiple race conditions exist in suexec between the validation and usage of directories and files. Under certain conditions local users are able to escalate privileges and execute arbitra...
Ubuntu 5.10 / 6.06 LTS / 6.10 : krb5 vulnerabilities (USN-449-1)
The krb5 telnet service did not appropriately verify user names. A remote attacker could log in as the root user by requesting a specially crafted user name. CVE-2007-0956 The krb5 syslog library did not correctly verify the size of log messages. A remote attacker could send a specially crafted...
youtube-bypass.txt
Youtube.com requires account creation and login before allowing visitors to view videos flagged by users as inappropriate. Sample flagged video: http://www.youtube.com/watch?v=Chei2buYo9s "This video may contain content that is inappropriate for some users, as flagged by YouTube's user community...
CVE-2007-1913
The TRUSTEDSYSTEMSECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...
CVE-2007-1913
The TRUSTEDSYSTEMSECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...
CVE-2007-1913
The CVE-2007-1913 entry pertains to SAP RFC Library 6.40 and 7.00 before 20061211. It describes an information-disclosure vulnerability in the TRUSTED_SYSTEM_SECURITY function that could allow remote attackers to verify the existence of users and groups on systems and domains via unspecified vect...
CVE-2005-2949
The CVE-2005-2949 entry concerns the PAM module pam_per_user prior to version 0.4. The issue is that it does not verify if the user name changes between authentication attempts and reuses the same subrequest handle, enabling attack scenarios where an attacker (remote or local) could log in as ano...
CVE-2002-1758
PHProjekt 2.0 through 3.1 allows remote attackers to view or modify data via requests to certain scripts that do not verify if the user is logged in...
