278 matches found
PT-2013-2416
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.0.0 through 8.5.0.1 Description The issue is related to the improper validation of authentication cookies when SSL is not enabled. This allows remote authenticated users to bypa...
CVE-2013-0540: Improper Authentication
IBM WebSphere Application Server WAS Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session...
ICS-CERT Warns of Serious Flaws in Tridium Niagara Software
The DHS and ICS-CERT are warning users of some popular Tridium Niagara AX industrial control system software about a series of major vulnerabilities in the applications that are remotely exploitable and could be used to take over vulnerable systems. The bugs, discovered by researchers Billy Rios...
HTTP Client MS Credential Relayer
This module relays negotiated NTLM Credentials from an HTTP server to multiple protocols. Currently, this module supports relaying to SMB and HTTP. Complicated custom attacks requiring multiple requests that depend on each other can be written using the SYNC options. For example, a CSRF-style...
Tumblr Users Should Beware of Cookie Thieves
Two researchers say they’ve found a security hole in Tumblr, one of the most popular sites on the Internet, that could steal users’ authentication cookies to break into their accounts. Aditya Gupta and Subho Halder say they’ve tried to contact Tumblr about the vulnerability by using mail and...
Microsoft Forefront UAG Default Reflected Cross-site Scripting (MS11-079; CVE-2011-1897)
A cross-site scripting vulnerability has been reported in Microsoft Forefront Unified Access Gateway UAG server. The vulnerability is due to an error in the way the UAG server handles incoming HTTP query strings. A remote attacker could exploit this issue by enticing a user to open a URL containi...
phpMyAdmin 3.4.x < 3.4.5 XSS (PMASA-2011-14)
The version of phpMyAdmin on the remote host is 3.4.x prior to 3.4.5. This version is affected by multiple cross-site scripting vulnerabilities: - The data used in the row content display after inline editing is not properly sanitized before it is passed back to the browser. - The data passed in ...
phpMyAdmin 3.4.x < 3.4.5 Multiple XSS (PMASA-2011-14)
Binary data 6026.prm...
Collabtive 'managechat.php' SQL Injection Vulnerability
Collabtive is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:collabtive:collabtive...
Collabtive 'managechat.php' SQL Injection Vulnerability
This host is running Collabtive and is prone SQL injection vulnerability. OpenVAS Vulnerability Test $Id: gbcollabtivesqlinjvuln.nasl 5263 2017-02-10 13:45:51Z teissa $ Collabtive 'managechat.php' SQL Injection Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2010 Greenbone Networks GmbH...
Wiccle Web Builder CMS / iWiccle CMS Community Builder Cross Site Scripting
Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple Cross-Site Scripting Vulnerability. SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1005 09/07/2010 Issue Discovered 09/10/2010 Vendor Notified 09/13/2010 Vendor Confirmed 09/14/2010 Fix Available Class: Cross-Si...
PT-2008-2977
Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.x through 3.1.x Description The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cooki...
WordPress Core 2.2 - 'Request_URI' Cross-Site Scripting
source: https://www.securityfocus.com/bid/24383/info WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This...
Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ======================================================= Wordpress 2.2 xmlrpc.php Remote SQL Injection Exploit ======================================================= / El error, bastante tonto por cierto, se encuentra en la funcion...
EVA-Web 2.1.2 - 'article-album.php3?debut_image' Cross-Site Scripting
source: https://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the...
Land Down Under <= 800 Multiple Vulnerabilities
The remote web server contains a PHP script that permits SQL injection and cross-site scripting attacks. Description : The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magicquotes' setting is disabled due to its failure to...
Land Down Under <= 801 Multiple Vulnerabilities
Land Down Under is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2006 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PunBB install.php XSS
The remote version of PunBB is vulnerable to cross-site scripting flaws through SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PunBB < 1.2.8 Multiple Vulnerabilities
According to its banner, the version of PunBB installed on the remote host suffers from several flaws. - A File Include Vulnerability The application fails to validate the 'language' parameter when a user updates his profile and uses that throughout the application to require PHP code in order to...