Liferay 6.1.0 CE - Privilege Escalation

Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation Date: 18/05/2015 Exploit Author: Massimo De Luca - mentat.is Vendor Homepage: https://www.liferay.com Software Link: http://www.liferay.com/it/community/releases/-/assetpublisher/nSr2/content/id/18060360 Version: 6.1.0 CE Tested on: -...

Concrete CMS: No csrf protection on index.php/ccm/system/user/add_group, index.php/ccm/system/user/remove_group

crayons There is no csrf protection on index.php/ccm/system/user/addgroup, and index.php/ccm/system/user/removegroup. A malicious POST request can be constructed to add or remove group membership from arbitrary users, if a logged-in admin surfs to a compromised site. For example, a registered use...

CVE-2014-8616

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

CVE-2014-8616

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

Fortinet FortiADC User Group Menu Cross-Site Scripting Vulnerability

Fortinet FortiADC is a load balancing service solution. A cross-site scripting vulnerability exists in Fortinet FortiADC User Group Menu Processing, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain sensitive information ...

Vimeo: Invite any user to your group without even following him

Hi, I can invite any user on vimeo.com to my group without even following him. Request : POST /groups/303339 HTTP/1.0 Host: vimeo.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:36.0 Gecko/20100101 Firefox/36.0 Accept: text/javascript, text/html, application/xml, text/xml, /...

IPass Control Pipe Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'IPass Control Pipe Remote Command Execution', 'Description' = %q This module exploits a vulnerability in the IPass Client service...

iPass Control Pipe Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the IPass Client service. This service provides a named pipe which can be accessed by the user group BUILTIN\Users. This pipe can be abused to force the service to load a DLL from a SMB share. This module requires Metasploit:...

Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation

Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation Vendor: Ubisoft Entertainment S.A. Product web page: http://www.ubi.com Affected version: 5.0.0.3914 PC Summary: Uplay is a digital distribution, digital rights management, multiplayer and communications service created by...

Common SQL Server 2 0 0 0 vulnerability and its associated use-vulnerability warning-the black bar safety net

A, empty or weak password Beginners in the SQL Server installation in order to save, the SQL Server Administrator sa is empty or weak password, so the danger is very great, and these dangerous often beginners are not aware of, the little King feel that their library is test data, nothing with, ev...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...

PT-2014-5659 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 3.5.3 Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the entity parameter in an update action to "user/fiche.php" or the sortorder parameter to...

MercuryBoard 1.1 INDEX.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12503/info MercuryBoard is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before being used in SQL queries. The vulnerability is reported ...

IBM DB2 Shared Library Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8346/info IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower...

Discuz某处XSS劫持UC_KEY（XSS应用详细过程）

简要描述： Discuz某处XSS劫持UCKEY到拿webshell。 XSS应用的详细过程。 详细说明： 漏洞： 这个漏洞的位置在Discuz的门户功能处。 在发表文章时，打开“编辑源码”功能时，写入任意XSS CODE后，再进入和输出都没有过滤。导致存储型XSS。 大家都知道，这里的XSS虽然可以劫持到用户和管理的Cookies，但是没什么用，无法登陆。 那么，我们可以想办法拿XSS来干点其他的，比如劫持管理员后台内容，如UCKEY等。 门槛： 因为默认安装情况下这个门户功能是没有配置的。 所以管理员需要手动配置门户功能。大部分都会开启门户。...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

Design/Logic Flaw

The image creation configuration in aaabase before 16.26.1 for openSUSE 13.1 KDE adds the root user to the "users" group when installing from a live image, which allows local users to obtain sensitive information and possibly have other unspecified impacts, as demonstrated by reading /etc/shadow...

CVE-2013-7209

The CVE-2013-7209 entry concerns JForum (Java-based forum) with a CSRF flaw in the Admin module, specifically admBase/login.page. The vulnerability affects the adminUsers/group permissions flow via the groupsSave action, enabling an attacker to hijack an administrator’s session and cause arbitrar...

CVE-2013-7209

Cross-site request forgery CSRF vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action...