Cross site request forgery (csrf)

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...

CVE-2013-4731

CVE-2013-4731 affects the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem. The vulnerability is in the web interface’s ajax.cgi. It allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the pip parameter of an Ajax tag_ipPing request. This is a distinct...

CVE-2013-4731

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...

CVE-2013-3581

The CVE-2013-3581 entry affects the web interface of the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem. The vulnerability lies in ajax.cgi where remote attackers can obtain sensitive information via Ajax requests (wmxState or netState). The provided documents describe the affected compon...

CVE-2013-3581

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax 1 wmxState or 2 netState request...

Choice Wireless Green Packet 4G WiMax modem vulnerability

Overview Choice Wireless Green Packet 4G WiMax modem, model number WIXFMR-111, fails to properly validate ajax requests allowing a remote unauthenticated attacker to view system configuration information or possibly execute commands on the device. Description It has been reported that Choice...

GLPI 0.83.8 - Multiple Vulnerabilities

GLPI 0.83.8 - Multiple Vulnerabilities GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 and 0.83.8 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free...

GLPI 0.83.8 - Multiple Vulnerabilities

GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 and 0.83.8 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free Management of Computer Equipment, was...

PT-2013-41: Arbitrary Code Execution in Ajax File and Image Manager

The specialists of the Positive Research center have detected "Arbitrary Code Execution" vulnerability in Ajax File and Image Manager. Due to incorrect application architecture, validation of file extension is implemented after uploading file. Uploaded file will subsequently be removed if its...

GLPI v0.83.8 Multiple Error-based SQL Injection Vulnerabilities

Summary GLPI, an initialism for Gestionnaire libre de parc informatique Free Management of Computer Equipment, was designed by Indepnet Association a non profit organisation in 2003. GLPI is a free asset and IT management software package, it also offers functionalities like servicedesk ITIL or...

ajax

This plugin greps every page for traces of Ajax code. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly whats under the hood: Plugin source code...

MyBB Ajax Chat SQL Vulnerability

Dork: intitle:MyBB Ajax Chat http://server/chatframe.php?rs=getChats&rsargs=" http://wolf-den.net/forums/chatframe.php?rs=getChats&rsargs=" http://www.cycle-soft.com/forum/chatframe.php?rs=getChats&rsargs=" http://www.forofusion.com/chatframe.php?rs=getChats&rsargs="...

74CMS talent system v3. 2 injection and full version pass rounded out the background is attached using the EXP-bug warning-the black bar safety net

Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to convert the submitted over the data encoding into utf8 So the use of wide-character injection there is no way out but the...

74CMS talent system v3. 2 injection& full version pass rounded out the background-bug warning-the black bar safety net

Because a station with this system next to the station is also no start so went down the parts of the source code to read Set of procedures filter is still relatively full, but all versions are GBK encoding is his flawed but basically the string into the library when the author used the iconv to...

WordPress Plugin Spider Event Calendar 1.3.0 - Multiple Vulnerabilities

WordPress Plugin Spider Event Calendar 1.3.0 - Multiple Vulnerabilities waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Locatio...

WordPress Plugin Spider Event Calendar 1.3.0 - Multiple Vulnerabilities

waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-104.html Descriptio...

Spider Event Calendar 1.3.0 Cross Site Scripting / Path Disclosure / SQL Injection

waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-104.html Descriptio...

WordPress Plugin WP Cleanfix - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/59940/info The WP cleanfix plugin for WordPress is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are...

CVE-2013-3535

Multiple cross-site scripting XSS vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 adminemail, 2 headertitle, 3 sitetitle parameter to admin/settings; 4 recaptchaprivate or 5 recaptchapublic parameter to admin/captchasettings; 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMSLogik 1.2.0 and 1.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 adminemail, 2 headertitle, 3 sitetitle parameter to admin/settings; 4 recaptchaprivate or 5 recaptchapublic parameter to admin/captchasettings; 6...