4249 matches found
python-django: caching of anonymous pages could reveal CSRF token
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
python-django: caching of anonymous pages could reveal CSRF token
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
CVE-2014-2983
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...
DEBIAN-CVE-2014-0473
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
UBUNTU-CVE-2014-2983
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...
PYSEC-2014-2
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
CVE-2014-2983
CVE-2014-2983 affects Drupal 6.x before 6.31 and 7.x before 7.27. The issue is an information disclosure where cached data from anonymous users is not properly isolated, potentially allowing remote anonymous users to access sensitive interim form input information in opportunistic scenarios via u...
CVE-2014-2983: Exposure of Sensitive Information to an Unauthorized Actor
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...
UBUNTU-CVE-2014-0473
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
ASUS RT Series Routers FTP Service - Default anonymous access
Five ASUS RT series routers suffer from a vendor vulnerability that default FTP service to anonymous access, full read/write permissions. The service, which is activated from the administrative console does not give proper instructions nor indications that the end user needs to manually add a use...
Avatars appear on Activity Stream even for anonymous users
Every user, independent of privileges, is able to see entries related to user's avatar change on Activity Stream. It also happens for users that are not logged in. See attached image...
Ukrainian Hacker falsely claimed theft of 800 million Credit Card
800 Million US based Credit and Debit cards compromised! Really it’s a big number and till now it has not been sized by the cyber security officials but a hacker group claims that they had stolen data on hundreds of millions of U.S. card accounts. Last week, the hacker group called itself Anonymo...
JSON-RPC API allows anonymous content rendering
The renderContent method can be used by anonymous users, leaking information, and allowing macro execution. Should the entire JSON-RPC be inaccessible to anonymous users if anonymous users can't use confluence?...
JSON-RPC API allows anonymous content rendering
The renderContent method can be used by anonymous users, leaking information, and allowing macro execution. Should the entire JSON-RPC be inaccessible to anonymous users if anonymous users can't use confluence?...
JSON-RPC API allows anonymous content rendering
The renderContent method can be used by anonymous users, leaking information, and allowing macro execution. Should the entire JSON-RPC be inaccessible to anonymous users if anonymous users can't use confluence?...
Fedora 20 : ReviewBoard-1.7.22-2.fc20 (2014-3446)
New upstream security release 1.7.22 - http://www.reviewboard.org/docs/releasenotes/reviewboa rd/1.7.22/ - Security Fixes : - An XSS vulnerability was found in the Search field's auto-complete. - New Features : - Added support for anonymous access to public Local Sites. - Added support for...
Blank password may bypass user authentication
The ActiveDirectoryLdapAuthenticator does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password...
US Prosecutor drops Criminal charges against Barrett Brown
U.S. Prosecutors decided not to pursue crucial criminal charges against journalist and activist Barrett Brown, and dismiss a majority of charges related to sharing a link to a dump of credit card numbers connected to the breach of intelligence firm Stratfor. Supporters say Brown just copied the...
Russia Today (RT) Hacked, "Russian" replaced with "Nazi" in News Headlines
'Russia Today', Moscow based Russia's biggest news channel website RT.com has been hacked and defaced by an unknown group of hackers. Hackers have replaced “Russia” or “Russians” with “Nazi” or “Nazis” word from the headlines, as shown. "RT website has been hacked, we are working to resolve the...
Anonymous SFTP Enabled
The remote SSH service supports anonymous SFTP logins. A remote user may connect and authenticate without providing unique credentials. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid72664; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2014/02/24 17:53:58 $";...