399 matches found
Atlassian Crucible Server 3.9.x < 3.9.2 Multiple Vulnerabilities
Binary data 9781.prm...
4Images 1.7.13 - SQL Injection Vulnerability
Exploit for php platform in category web applications vulnerable app : 4images query$sql; Input parameter orderby is not sanitized before being passed to the sql query which lead to sql injection flaw POC GET...
Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting
Subrion CMS 4.0.5 - Cross-Site Request Forgery Bypass Persistent Cross-Site Scripting Exploit Title: Subrion CMS 4.0.5 - CSRF Bypass to Persistent XSS and Add-Admin Date: 15-10-2016 Software Link: http://www.subrion.org/download/ Vendor: http://www.subrion.org Google Dork: "Powered by Subrion CMS...
Django security restrictions bypass Vulnerability(CVE-2 0 1 6-7 4 0 1)-vulnerability warning-the black bar safety net
Affected system: Django Django 1.8.15 Django Django 1.9. x 1.9.10 Description: BUGTRAQ ID: 9 3 1 8 2 CVECAN ID: CVE-2 0 1 6-7 4 0 1 Django is the Python programming language to drive an open source Web application framework. Django 1.8.15, and 1.9. x 1.9.10 version, cookie parsing code with the...
[SECURITY] [DLA DLA-649-1] python-django security update
Package : python-django Version : 1.4.22-1+deb7u1 CVE ID : CVE-2016-7401 It was discovered that there was a possible CSRF protection bypass on sites that use Google Analytics in python-django, a High-level Python web development framework. More information can be found in the upstream announcemen...
Django Cross-Site Request Forgery Vulnerability
Django is a set of Django Software Foundation based on the Python language open source Web application framework. The framework includes object-oriented mapper , view system , template system and so on. Cross-site request forgery vulnerability exists in Django version 1.8 and 1.9. An attacker can...
Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple Vulnerabiliti
Exploit for php platform in category web applications Video: https://www.youtube.com/watch?v=yOWz25sHMI SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Potential backdoor access through multiple vulnerabilities product...
CVE-2016-7034
The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...
Mail.ru: [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info'
Hi, I noticed that when we change userinfo of https://cfire.mail.ru from here: https://cfire.mail.ru/account/userinfo, there are two Anti-CSRF tokens or you can say that; they just do the work of Anti-CSRF token: - signature - submit2 Actually, I was able to bypass both Anti-CSRF tokens, and afte...
Ubuntu 14.04 LTS / 16.04 LTS : Tomcat vulnerabilities (USN-3024-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3024-1 advisory. It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePat...
WebCalendar 1.2.7 - Multiple Vulnerabilities
Exploit for php platform in category web applications + Credits: John Page aka HYP3RLINX + ISR: ApparitionSec Vendor: ========================== www.k5n.us/webcalendar.php Product: ================== WebCalendar v1.2.7 WebCalendar is a PHP-based calendar application that can be configured as a...
Sucuri: CRLF/HTTP header injection www.sucuri.net
I would like to report a security vulnerability on www.sucuri.net. The domain appears to be vulnerable for CRLF or HTTP header injection. This allows attackers to construct a URL that injects HTTP headers in the server's response. One of the things an attacker can do is injecting a "Set-Cookie"...
Amazon Linux: Security Advisory (ALAS-2016-679)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2016:0822-1 Security update for tomcat
This update for tomcat fixes the following security issues. Tomcat has been updated from 7.0.55 to 7.0.68. CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended SecurityManager restrictions and list a parent...
Updated tomcat packages fix security vulnerabilities
Updated tomcat packages fix security vulnerabilities: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x before 7.0.65 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used b...
CVE-2015-5351
The 1 Manager and 2 Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token...
CVE-2015-5351
The 1 Manager and 2 Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token...
CakePHP Security Bypass Vulnerability
CakePHP is the United States Cake Software Foundation of a MVC-based architecture , open source Web development framework. The framework has a flexible view caching , automatic generation of CRUD code and other features . A security vulnerability exists in CakePHP version 2.x and version 3.x befo...