CVE-2008-7193

PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery CSRF attacks by reading the PHPKITSID parameter from the HTTP Referer and using it in a request to 1 modify the user profile via uploadfiles/include.php or 2 create a new...

Default credentials

ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the profile of arbitrary users via a modified uid variable to siteadmin/useredit.php. NOTE: this can be used to recover the password of the user by using the modified e-mail address i...

IBM Tivoli Identity Manager 5.0.5 - User Profile HTML Injection

source: https://www.securityfocus.com/bid/36293/info IBM Tivoli Identity Manager is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in...

CVE-2008-7076

Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. Star Articles 6.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a profile photo, then accessing it via a direct request to the file in...

MyWeight 1.0 Remote Shell Upload Vulnerability

No description provided by source. ======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :MyWeight 1.0 Shell Upload Vulnerability + D0rk : Powered By phplemon.com + Script si...

CVE-2008-6886: Undefined Security Weakness

RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote attackers to obtain the administrator password hash and conduct brute force guessing attacks...

In-portal 4.3.1 - Arbitrary File Upload

======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :In-Portal v 4.3.1 Shell Upload Vulnerability + D0rk : Powered by In-portal ® 1997-2009, + Script site :...

SuperCali PHP Event Calendar Arbitrary Change Admin Password Exploit

No description provided by source. --------------------------------------------------------------- SuperCali PHP Event Calendar Arbitrary Change Admin Password Exploit --------------------------------------------------------------- Founder :TiGeR-Dz Home:http://www.h4ckf0ru.com Script:SuperCali P...

CVE-2009-0664

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via 1 the introduction field in a user profile or 2 an arbitrary text block in a user view...

CVE-2009-0664

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via 1 the introduction field in a user profile or 2 an arbitrary text block in a user view...

FreeBSD : drupal -- multiple vulnerabilities (6d85dc62-f2bd-11dd-9f55-0030843d3802)

Drupal Team reports : The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content a node. In that proces the existing node's content is copied into the new node's submission form. The module contains a flaw that allows a user with the 'translat...

Star Articles 6.0 - Remote Contents Change

Star Articles 6.0 - Remote Contents Change ----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG---- Author : ByALBAYX Website : WWW.C4TEAM.ORG Script :Star Articles 6.0 Site :http://www.stararticles.com Download :http://cmsnx.com/psf/order.php?id=5 $ :175$ http://www.c4team.org/ PATH...

Star Articles 6.0 Contents Change

----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG---- Author : ByALBAYX Website : WWW.C4TEAM.ORG Script :Star Articles 6.0 Site :http://www.stararticles.com Download :http://cmsnx.com/psf/order.php?id=5 $ :175$ http://www.c4team.org/ PATH /stararticle/user.modify.profile.php?userid=1 Add...

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Access Bypass The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content a node. In that process the existing node's content is copied into the new node's submission form. The...

getaphpsite Auto Dealers - Arbitrary File Upload

getaphpsite Auto Dealers - Arbitrary File Upload geta php cardealers Remote File upload ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 22.11.2008 Home: www.z0rlu.blogspot.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA :...

getaphpsite Real Estate - Arbitrary File Upload

geta php Real Estate Remote File upload ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 22.11.2008 Home: www.z0rlu.blogspot.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA :...

PHPStore Real Estate Remote File Upload Vulnerability

No description provided by source. PHP Store Real Estate Remote File Upload Author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ----------------------------------------- exploit: first register to site you add this code your shell ...

zeeproperty 1.0 (Upload/XSS) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ zeeproperty 1.0 Upload/XSS Multiple Remote Vulnerabilities ============================================================ ZEEPROPERTY v1.0 remote file Upload & XSS author: ZoRLu ms...

Information Leakage in Opera

Здравствуйте 3APA3A! Для недавно опубликованной Cross-Site Scripting уязвимости в Opera http://www.milw0rm.com/exploits/6801 я разработал свой эксплоит. Который приводит к утечке пути к профайлу пользователя и соответственно к утечке логина пользователя в ОС. Information Leakage:...

CVE-2008-3937

Multiple cross-site scripting XSS vulnerabilities in Open Media Collectors Database OpenDb 1.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 userid parameter in an edit action to useradmin.php, the 2 title parameter to listings.php, and the 3 redirecturl parameter to...