Blood Bank & Donor Management System version 2.4 is vulnerable to CSRF attacks due to the lack of CSRF tokens for essential functions like logout. By creating a malicious iframe with the logout URL, an attacker can deceive a user into clicking it, resulting in the user being logged out without their knowledge.
CSRF exploit that allows adding a new admin
This exploit takes advantage of a buffer overflow vulnerability in CORE Multimedia Suite 2011 CORE Player 2.4. By loading a malicious playlist, an attacker can trigger the overflow and potentially execute arbitrary code.
ASPRunner versions 2.4 and prior are affected by multiple vulnerabilities including SQL injection, cross-site scripting, information disclosure, and unauthorized access to database files. An attacker can exploit these issues by sending a crafted HTTP request to the affected server.
The HP JetDirect FTP Print Server is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue on an affected computer to deny service to legitimate users.
ALPHA Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Rumba XML is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
The application fails to sanitize user-supplied data, leading to multiple XSS vulnerabilities. An attacker can execute arbitrary script code in the context of the affected website, potentially stealing authentication credentials and launching further attacks.
A Bozon vulnerability allows unauthenticated attackers to add arbitrary users and inject system commands to the "auto_restrict_users.php" file of the Bozon web interface. This issue results in arbitrary code execution on the affected host, attackers system commands will get written and stored to the PHP file "auto_restrict_users.php" under the private/ directory of the Bozon application, making them persist. Remote attackers will get the command responses from functions like phpinfo() as soon as the HTTP request has completed. In addition when an admin or user logs in or the webpage gets reloaded the attackers commands are then executed as they are stored. If a Command is not injected to the "auto_restrict_users.php" file, unauthenticated attackers can opt to add user accounts at will.
The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
Services By CQR