685 matches found
USN-2347-1 python-django vulnerabilities
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...
Updated python-django packages fix multiple vulnerabilities
Updated python-django and python-django14 packages fix security vulnerabilities: These releases address an issue with reverse generating external URLs CVE-2014-0480; a denial of service involving file uploads CVE-2014-0481; a potential session hijacking issue in the remote-user middleware...
Code injection
The Accounts tab in the administrative user interface in McAfee Web Gateway MWG before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors...
CVE-2014-0483
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
PYSEC-2014-7
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
CVE-2014-0483
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
Ipswitch WhatsUp Professional 2006 Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based administrative interface of t...
ZaireWeb Solutions Newsletter ZWS Administrative Interface Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10605/info Newsletter ZWS is reported prone to an administrative interface authentication bypass vulnerability. The vulnerability exists due to a design error in the implementation of the authentication system for the...
Macromedia JRun 4.0 build 61650 Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/9112/info A number of cross-site scripting vulnerabilities have been reported for Macromedia Jrun, specifically in the administrative interface. The problem is said to occur due to insufficient sanitization of URI...
GetSimple CMS 3.3.1 - Persistent Cross Site Scripting
No description provided by source. Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting Google Dork: N/A Date: 24-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Version: v3.3.1 Tested on: N/A CVE :...
Ruslan Communications <Body>Builder SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5008/info Ruslan Communications BodyBuilder is a tool designed to assist a user in creating a website. It allows for remote administration through a web interface, and is implemented in Java. Reportedly, user input suppli...
atmail email server appliance 6.4 - Stored XSS - csrf - rce
No description provided by source. Exploit Title: Atmail Email Server Appliance 6.4 Remote Code Execution Date: Jul 21 2012 Author: muts Version: Atmail Email Server 6.4 By sending an email to a user with the Atmail administrative interface open, we can call a remote JavaScript file that will...
Working Resources 1.7.x BadBlue Administrative Interface Arbitrary File Access
No description provided by source. source: http://www.securityfocus.com/bid/5276/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. BadBlue does not sufficiently control access to the administrative interface. ...
PHPWCMS 1.4.5 r398 Cross Site Request Forgery Vulnerability
No description provided by source. ?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah...
EServ 2.9x Password-Protected File Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3838/info EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems. It is possible to construct a web request which is capable of accessing the contents of password protected...
Seyeon FlexWATCH Network Video Server 2.2 Unauthorized Administrative Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8942/info It has been reported that FlexWATCH Network Video Server may be prone to an access validation error that may allow a remote attacker to gain administrative access to the system. The problem is reported to presen...
Netgear WGR614v9 - Wireless Router Get Request Denial of Service Vuln
No description provided by source. LUNOSEC ADVISORY Synopsis: Denial of Service condition in Netgear's WGR614v9 Wireless Router Firmware version tested: v1.2.214.0.13NA LATEST Firmware version tested: WNR834Bv2 v2.0.82.0.8 GTADarkDude tested Proof of Concept: Appending a question mark to the...
FloosieTek FTGatePro 1.22 Mail Server Path Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8527/info FloosieTek FTGatePro Mail Server may disclose its installation path to remote attackers. This information could be useful when mounting further attacks against the system. This issue exists in the web...
LevelOne AMG-2000 2.00.00 Security Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/34760/info LevelOne AMG-2000 is prone to a security-bypass vulnerability. Attackers may exploit this issue to gain access to the administrative interface and internal computers from an outside network. This may aid in...
FortiGate Firewall 2.x Policy Admin Interface XSS
No description provided by source. source: http://www.securityfocus.com/bid/9033/info Multiple cross-site scripting vulnerabilities have been reported in the FortiGate Firewall web administrative interface. These issues could be exploited by enticing an administrative user to follow a malicious...