Stored XSS in OnDemand Confluence Header via username

This is from an external report. Creating a user with username: code " code and returning to the dashboard will demonstrate the script injection. This PoC will not work in Chrome/Chromium, but will in Firefox and other browsers that do not have such protective measures...

Stored XSS in OnDemand Confluence Header via username

This is from an external report. Creating a user with username: code " code and returning to the dashboard will demonstrate the script injection. This PoC will not work in Chrome/Chromium, but will in Firefox and other browsers that do not have such protective measures...

Stored XSS in OnDemand Confluence Header via username

This is from an external report. Creating a user with username: code " code and returning to the dashboard will demonstrate the script injection. This PoC will not work in Chrome/Chromium, but will in Firefox and other browsers that do not have such protective measures...

Atmail Webmail < 6.3.5 Multiple XSS Vulnerabilities

According to its version, the Atmail Webmail install on the remote host is a version prior to 6.3.5. It is, therefore, potentially affected by the following vulnerabilities : - An input validation error exists related to log search functionality and the 'range' and 'index' parameters. - An input...

Microweber CMS 0.93 - CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC...

Microweber CMS 0.93 - Cross-Site Request Forgery

Exploit Title: Microweber CMS v0.93 CSRF Vulnerability Author: sajith version: Microweber CMS v0.93 Vendor Homepage: http://microweber.com/ vulnerable app link:http://microweber.com/download Application is vulnerable to CSRF.below is the POC where attacker can use this vulnerability to create new...

CVE-2014-2034

Unspecified vulnerability in Sonatype Nexus OSS and Pro 2.4.0 through 2.7.1 allows attackers to create arbitrary user accounts via unknown vectors related to "an unauthenticated execution path."...

Piwigo 2.6.1 - Cross-Site Request Forgery

Piwigo 2.6.1 - Cross-Site Request Forgery Exploit Title: piwigo 2.6.1 - CSRF Date: 26/02/2014 Exploit Author: [email protected] Vendor Homepage: http://it.piwigo.org/ Software Link: http://it.piwigo.org/basics/downloads Version: 2.6.1 Tested on: Virtualbox debian A CSRF problem is present in the...

Design/Logic Flaw

The encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils before 90 does not properly ensure that the passphrase file is created, which might allow local users to bypass intended access restrictions at a certain time in the new-user creation steps...

CVE-2011-1835

The encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils before 90 does not properly ensure that the passphrase file is created, which might allow local users to bypass intended access restrictions at a certain time in the new-user creation steps...

Fedora Update for munin FEDORA-2013-22968

Check for the Version of munin OpenVAS Vulnerability Test Fedora Update for munin FEDORA-2013-22968 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

Ability Mail Server 2013 -Persistent Cross-Site Scripting / Cross-Site Request Forgery (Password Reset)

On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a user named, victim, with a password of victim 5. Finish...

PHPJabbers Property Listing Script 2.0添加管理员CSRF漏洞

No description provided by source. Property Listing Script V2.0 - Add Admin CSRF Vulnerability ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Conceptronic Wireless Pan & Tilt Network Camera - CSRF Vulnerability

Exploit for hardware platform in category web applications Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8 AV:N/AC:M/AU:N/C:P/I:P/A:N Vulnerability Type: Cross-Site Request Forgery...

[CVE-2013-7204] CSRF in Conceptronic IP Camera &#40;CIPCAMPTIWL&#41;

Hello List, Here I inform you about an easily exploitable CSRF discovered in Conceptronic cameras CIPCAMPTIWL. General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8...

Piwigo - admin.php Cross-Site Request Forgery (User Creation)

Piwigo - admin.php Cross-Site Request Forgery User Creation source: https://www.securityfocus.com/bid/64357/info Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute...

eFront 3.6.14 Cross Site Scripting Vulnerability

eFront version 3.6.14 build 18012 suffers from multiple stored cross site scripting vulnerabilities. EDB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage:...

eFront 3.6.14 (build 18012) - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit-DB Note: Screenshot provided by exploit author. Exploit Title: eFront v3.6.14 build 18012 -Stored XSS in multiple Parameters Author: sajith version: eFront v3.6.14- build 18012 Vendor Homepage: http://www.efrontlearning.net/ vulnerable app link:http://www.efrontlearning.net/download POC b...

PT-2013-5035 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite versions 5.6 and earlier Description: The issue allows remote attackers to create administrator accounts due to the web interface not being disabled. Recommendations: For Red Hat Satellite versions 5.6 and earlier, disable t...

Opsview pre 4.4.1 - Blind SQL Injection

Opsview pre 4.4.1 - Blind SQL Injection CVE-2013-5694 Blind SQL Injection in Ops View Versions: Opsview pre 4.4.1 Author: J. Oquendo joquendo at e-fensive dot net I. ADVISORY Title: Blind SQL Injection in OpsView Date published: 2013-10-28 Vendor contacted: 2013-09-04 II. BACKGROUND Opsview is a...