Beckhoff IPC Diagnostics Arbitrary User Creation Vulnerability

Beckhoff IPC Diagnostics is a set of support software pre-installed in all Beckhoff IPCs/PLCs Programmable Logic Controllers running on the Microsoft Windows operating system. Beckhoff IPC Diagnostics fails to properly restrict access to functions in the /config URI, allowing a remote attacker to...

CVE-2015-4051

Beckhoff IPC Diagnostics before 1.8 does not properly restrict access to functions in /config, which allows remote attackers to cause a denial of service reboot or shutdown, create arbitrary users, or possibly have unspecified other impact via a crafted request, as demonstrated by a...

Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

MGASA-2015-0204 Updated glpi packages fix a security vulnerability

Updated glpi package fixes security vulnerability: Any user who has the rights to create a new user can create a super-admin user...

Xeams 4.5 Build 5755 - Multiple Vulnerabilities

Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/XeamsDownload.htm Version: 4.5 Build 5755...

[CVE-2015-1583] ATutor LCMS - CSRF Vulnerability in Version 2.2

CVE-2015-1583 ATutor LCMS - CSRF Vulnerability in Version 2.2 ---------------------------------------------------------------- Product Information: Software: ATutor LCMS Tested Version: 2.2, released 25.8.2014 Vulnerability Type: Cross-Site Request Forgery, CSRF CWE-352 Download link:...

Metasploit Project < 4.11.1 - Initial User Creation CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Metasploit Project initial User Creation CSRF Google Dork: N/A Date: 14-2-2015 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.metasploit.com/ Software Link:...

Metasploit Project < 4.11.1 - Initial User Creation Cross-Site Request Forgery (Metasploit)

Exploit Title: Metasploit Project initial User Creation CSRF Google Dork: N/A Date: 14-2-2015 Exploit Author: Mohamed Abdelbaset Elnoby @SymbianSyMoh Vendor Homepage: http://www.metasploit.com/ Software Link: http://www.rapid7.com/products/metasploit/editions-and-features.jsp Version: Free/Pro...

BEdita CMS 3.5.0 - Multiple Vulnerabilities

BEdita CMS 3.5.0 - Multiple Vulnerabilities BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 &...

BEdita CMS 3.5.0 - Multiple Vulnerabilities

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 & Cross-Site Request Forgery, CSRF CWE-352...

BEdita CMS 3.5.0 XSS & CSRF Vulnerabilities

BEdita CMS version 3.5.0 suffers from cross site request forgery and cross site scripting vulnerabilities. BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0,...

BEdita CMS 3.5.0 Cross Site Request Forgery / Cross Site Scripting

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 & Cross-Site Request Forgery, CSRF CWE-352...

ATutor LCMS 2.2 Cross Site Request Forgery

CVE-2015-1583 ATutor LCMS - CSRF Vulnerability in Version 2.2 ---------------------------------------------------------------- Product Information: Software: ATutor LCMS Tested Version: 2.2, released 25.8.2014 Vulnerability Type: Cross-Site Request Forgery, CSRF CWE-352 Download link:...

GLPI 0.85.2 Shell Upload / Privilege Escalation

Multiple vulnerabilities have been identified in GLPI http://www.glpi-project.org. 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and 0.85.2 Description ======= When an user wants to create a new ticket, he has the possibility to add an...

GLPI 0.85.2 Shell Upload / Privilege Escalation Vulnerabilities

GLPI versions 0.85 through 0.85.2 suffer from remote shell upload and privilege escalation vulnerabilities. Multiple vulnerabilities have been identified in GLPI http://www.glpi-project.org. 1/ Arbitrary file upload Severity: Important Versions Affected =========== All versions between 0.85 and...

Fat Free CRM 0.13.5 Cross Site Request Forgery Vulnerability

Fat Free CRM version 0.13.5 suffers from a cross site request forgery vulnerability. CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released...

Windows Manage PXE Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

CVE-2014-8802: Undefined Security Weakness

The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to 1 add a user by uploading a crafted CSV file or 2 activate a user account via a verifyit action...

Moderate: Red Hat Security Advisory: python-django-horizon security and bug fix update

Updated python-django-horizon packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scori...

WordPress custom-contact-forms Plugin SQL Upload

The WordPress custom-contact-forms plugin use auxiliary/admin/http/wp/customcontactforms msf undefinedcustomcontactforms show actions ...actions... msf undefinedcustomcontactforms set ACTION msf undefinedcustomcontactforms show options ...show and set options... msf undefinedcustomcontactforms ru...