52 matches found
CVE-2014-6607
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...
CVE-2014-6607
CVE-2014-6607 affects M/Monit 3.3.2 and earlier. The issue is a CSRF vulnerability where an attacker can change any user’s password via the fullname and password parameters to /admin/users/update because the application does not verify the original password before changing it. Impact is remote co...
M/Monit 3.2.2 Cross Site Request Forgery Vulnerability
M/Monit versions 3.2.2 and below suffer from multiple cross site request forgery vulnerabilities. Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the...
M/Monit 3.2.2 Cross Site Request Forgery
Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the issue, and a fix might be released in the future. 4. Time line: 15.9 - Found vulnerabilities 15.9 -...
CVE-2012-6607
The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786...
CVE-2012-6607
Summary (CVE-2012-0786, CVE-2012-0787, CVE-2013-6412) : AUGEAS up to 1.0.0 contains a symlink/permission bug in the transformation/save logic (transform_save in transform.c) and related file handling (clone_file/save paths). Exploitation can allow a local attacker to overwrite arbitrary files and...
CVE-2012-6607
The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786...
CVE-2008-6607
Cross-site scripting XSS vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter...
CVE-2007-6607
OpenBiblio 0.5.2-pre4 and earlier is affected. The vulnerability allows remote attackers to obtain sensitive information by directly requesting (1) shared/footer.php, (2) circ/mbr_fields.php, or (3) admin/custom_marc_form_fields.php, with error messages revealing internal paths. The CVE entry doc...
CVE-2006-6607
The CVE-2006-6607 vulnerability affects WebSphere Application Server (WAS) used with IBM Tivoli Identity Manager (ITIM) 4.6. The JKS password is exposed via a -Djavax.net.ssl.trustStorePassword command line argument, enabling local users to read the password by inspecting the process or similar m...