2014.adfest.by Open Redirect vulnerability

Open Bug Bounty ID: OBB-299782 Description| Value ---|--- Affected Website:| 2014.adfest.by Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

CVE-2014-8684

CVE-2014-8684 affects CodeIgniter before 3.0 and Kohana 3.2.3 and earlier, and 3.3.x through 3.3.2. The issue arises from using standard string comparison operators to compare cryptographic hashes, which enables remote attackers to spoof session cookies and conduct PHP object injection attacks. E...

CVE-2014-8686

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter vulnerability CVE-2014-8686 (CodeIgniter before 2.2.0) allows attackers to decode and manipulate the ci_session cookie by falling back to a custom XOR-based scheme when the PHP Mcrypt extension is unavailable. Public references describe exploitation via extracting the encryption key, ...

CVE-2014-6191

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568...

CVE-2014-8174

eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files...

CVE-2014-9619

CVE-2014-9619 affects Netsweeper Webadmin: unrestricted file upload via webadmin/ajaxfilemanager/ajaxfilemanager.php. An authenticated admin can upload a file with a double extension and, by requesting it from webadmin/deny/images/, execute arbitrary PHP code (e.g., secuid0.php.gif). Affected ver...

CVE-2014-9610

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and remove IP addresses from the quarantine via the ip parameter to webadmin/user/quarantinedisable.php...

CVE-2014-8174

eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files...

CVE-2014-9611

CVE-2014-9611 affects Netsweeper prior to 4.0.5. An unauthenticated remote attacker can bypass authentication via the request to webadmin/nslam/index.php and can create arbitrary user accounts and policies. This is evidenced by the CNVD-2017-30727 entry and the corroborating exploit references no...

CVE-2014-5362

CVE-2014-5362 affects LANDESK/Landesk Management Suite 9.6 and earlier. The admin interface is vulnerable to remote file inclusion via insufficient input validation, exploitable by crafting requests that set the d parameter in ldms/sm_actionfrm.asp or remote/frm_coremainfrm.aspx, or the top param...

CVE-2014-8174

CVE-2014-8174 relates to Red Hat eDeploy where an attacker can achieve remote code execution by abusing eDeploy’s handling of HTTP downloads. The linked sources explicitly describe eDeploy as a tool that facilitates remote code execution when files are downloaded over HTTP, enabling an attacker t...

CVE-2014-9616

CVE-2014-9616 affects Netsweeper versions prior to 3.1.10, 4.0.x prior to 4.0.9, and 4.1.x prior to 4.1.2. The issue allows remote attackers to obtain sensitive information by issuing a request that redirects to the deny page. Affected component/behavior is an information disclosure via misdirect...

CVE-2014-9610

Netsweeper versions affected: before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2. A remote attacker can bypass authentication and remove IP addresses from quarantine by supplying the ip parameter to webadmin/user/quarantine_disable.php. This is an authentication bypass vulnerability that a...

CVE-2014-9618

The CVE-2014-9618 vulnerability affects Netsweeper’s Client Filter Admin portal (versions before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2). It allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. Public sou...

CVE-2014-6106

CVE-2014-6106 affects IBM Security Identity Manager 5.1, 6.0, and 7.0. The exposure is a CSRF flaw that, via improper validation of requests, could allow a remote attacker to hijack an authenticated user’s session and trigger cross-site scripting, web cache poisoning, or other impacts described i...

CVE-2014-6106

Cross-site request forgery CSRF vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that can cause cross-site scripting attacks, web cache poisoning, or other unspecified impacts via unknown vectors...

CVE-2014-7808

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider...

CVE-2014-7808

CVE-2014-7808 affects Apache Wicket (versions prior to 1.5.13, 6.x prior to 6.19.0, and 7.x prior to 7.0.0-M5). The issue arises from using CryptoMapper as the default encryption provider, which can make it easier for attackers to defeat cryptographic protection and predict encrypted URLs. Remedi...

KingScada AlarmServer 3.1.2.13 Buffer Overflow Exploit

This Metasploit module exploits a stack based buffer overflow found in KingScada versions prior to 3.1.2.13. The vulnerability is triggered when sending a specially crafted packet to the 'AlarmServer' AEserver.exe service listening on port 12401. During the parsing of the packet the 3rd dword is...