51 matches found
CVE-2014-6607
CVE-2014-6607 affects M/Monit 3.3.2 and earlier. The issue is a CSRF vulnerability where an attacker can change any user’s password via the fullname and password parameters to /admin/users/update because the application does not verify the original password before changing it. Impact is remote co...
M/Monit 3.2.2 Cross Site Request Forgery Vulnerability
M/Monit versions 3.2.2 and below suffer from multiple cross site request forgery vulnerabilities. Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the...
M/Monit 3.2.2 Cross Site Request Forgery
Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the issue, and a fix might be released in the future. 4. Time line: 15.9 - Found vulnerabilities 15.9 -...
CVE-2012-6607
The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786...
CVE-2012-6607
Summary (CVE-2012-0786, CVE-2012-0787, CVE-2013-6412) : AUGEAS up to 1.0.0 contains a symlink/permission bug in the transformation/save logic (transform_save in transform.c) and related file handling (clone_file/save paths). Exploitation can allow a local attacker to overwrite arbitrary files and...
CVE-2012-6607
The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786...
CVE-2008-6607
Cross-site scripting XSS vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter...
CVE-2007-6607
OpenBiblio 0.5.2-pre4 and earlier is affected. The vulnerability allows remote attackers to obtain sensitive information by directly requesting (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, with error messages revealing internal paths. The CVE entry doc...
CVE-2006-6607
The CVE-2006-6607 vulnerability affects WebSphere Application Server (WAS) used with IBM Tivoli Identity Manager (ITIM) 4.6. The JKS password is exposed via a -Djavax.net.ssl.trustStorePassword command line argument, enabling local users to read the password by inspecting the process or similar m...