XWiki 4.2-milestone-2 Multiple Stored XSS Vulnerabilities

No description provided by source. Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki. Date: 26/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://www.xwiki.org Software Link: http://enterprise.xwiki.org/xwiki/bin/view/Main/Download Version: 4.2-milestone-2 Gr33Tz:...

TikiWiki Project 1.8 User Profile Multiple Option Arbitrary Remote Code Injection

No description provided by source. source: http://www.securityfocus.com/bid/10100/info Multiple vulnerabilities have been identified in various modules of the application. These vulnerabilities may allow a remote attacker to carry out various attacks such as path disclosure, cross-site scripting,...

iScripts CyberMatch 1.0 - Blind SQL Injection Vulnerability

No description provided by source. iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability Name iScripts CyberMatch Vendor http://www.iscripts.com Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date...

Multiple WebmasterSite Products Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30572/info Multiple WebmasterSite products are prone to a remote shell command-execution vulnerability because the applications fail to sufficiently sanitize user-supplied data. Successfully exploiting this issue will all...

noname script <= 1.1 - Multiple Vulnerabilities

No description provided by source. + NoName Script 1.1 BETA Multiple Remote Vulnerabilities + Discovered By SirGod + www.mortal-team.org + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz + Local File Inclusion...

Vacation Rental Script 4.0 - CSRF Vulnerability

No description provided by source. Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: 2006 - 2009 Vacation Rental Script Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted +WorKs ResPecT My FrienD...

SA-CONTRIB-2014-051 - Realname Registration - Information Disclosure

This module enables you to generate usernames based on fields filled out by the user during registration. The module doesn't sufficiently restrict access to the settings for determining which user fields are incorporated into usernames, and doesn't properly validate generated user names. Any user...

Self Stored Cross site scripting

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47188. panel Product: http://swag.atlassian.com Vulnerability Type: Self Stored Cross site scripting Cross site scripting...

MyBB Extended Useradmininfo Plugin 1.2.1 - Cross-Site Scripting

MyBB Extended Useradmininfo Plugin 1.2.1 - Cross-Site Scripting Exploit Title: Extended Useradmininfo MyBB Plugin 1.2.1 - Cross Site Scripting Google Dork: N/A Date: 09.02.2014 Exploit Author: Fikri Fadzil - [email protected] Vendor Homepage: http://forum.mybboard.de/user-9022.html...

Unrestricted file upload

Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in...

CVE-2014-0010

Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...

CVE-2014-0010

Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...

CVE-2014-0010

Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...

CVE-2014-0010: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete 1...

PT-2014-3432

Name of the Vulnerable Software and Affected Versions Moodle versions 2.2.11 and earlier, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, 2.6.x before 2.6.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests, specifically to dele...

HackerOne: Improper session management

When a request with an invalid authenticitytoken is received, the user is logged out tested for updating user's profile, which is available here: https://hackerone.com/diekatze/profile/edit and the user receives a new session cookie, which is not authenticated at this point. However, the...

HackerOne: Flawed account creation process allows registration of usernames corresponding to existing file names

As requested by Alex: "You mentioned in the report to contact you on this account instead. Is this the email address you prefer to use for payment? If so, would you mind resubmitting the issue from this account so we can issue a payout to the proper account?" ---------- The account creation proce...

VidiScript 1.0.3a Cross Site Scripting

. \ /| | \ \ \ \ | | | | / \ / \ /\ / \ / / / / / \ /\ / \ / / / | | | Y \ / \ | | \ /\ \ \ | | /\ /\ / || || /\ \ /|| / /// \ /|| \ // / / / / / / http://thecrowscrew.org Exploit Title: VidiScript Persistent XSS Vulnerability Author: Gabby Google Dork: Powered By VidiScript...

SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload

Exploit Title: Sending php file in the timeline plugin cover image of SocialEngine 4.5 Date: 2013-08-17 Discovered by: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://webhive.com.ua/ Software Link: http://webhive.com.ua/store/product.php?idproduct=46 Version: plugin Timeline 4.2.5p9 fo...

CVE-2013-0536

ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J2...