1467 matches found
Cisco Headend Digital Broadband Delivery System Cross-Site Request Forgery Vulnerability
A vulnerability in Cisco Headend Digital Broadband Delivery could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attacks on the affected device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker...
cURL and libcurl Default Configuration HTTP Headers Sending Vulnerability
cURL is a command-line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP protocols. libcurl for a free open source , client-side url transfer library . cURL and libcurl default configuration will send custom HTTP header field information to the proxy and...
CVE-2015-3153
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...
UBUNTU-CVE-2015-3153
The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents...
ThinkPHP 默认配置导致验证码暴力破解
简要描述： ThinkPHP 默认配置导致验证码暴力破解 详细说明： 最近用Thinkphp时发现，验证码类默认的check函数在检查完验证码是否正确后，并未重置session，导致可被暴力破解。 写这样的代码，再看看Verify类的check函数， public function check$code, $id = '' $key = $this-authcode$this-seKey.$id; // 验证码不能为空 $secode = session$key; ifempty$code || empty$secode return false; // session 过期...
Default configuration
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request...
DEBIAN-CVE-2014-9713
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors...
Debian DLA-163-1 : bind9 security update
Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-validation...
CrushFTP 7.2.0 - Multiple Vulnerabilities
======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting XSS vulnerabilities have been identified in Crushftp 7.2.0 Web Interface on default configuration. These vulnerabilities allows an...
CVE-2013-6919
The default configuration of phpThumb before 1.7.12 has a false value for the disabledebug option, which allows remote attackers to conduct Server-Side Request Forgery SSRF attacks via the src parameter...
CVE-2014-9249
The CVE-2014-9249 entry affects Zenoss Core before version 5, where the default configuration exposes services on open ports that allow remote attackers to read or modify database information (ZEN-15408). The connected sources corroborate this description but do not provide concrete remediation d...
Default configuration
The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2014-8399
The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors...
CVE-2014-8399
The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors...
Default configuration
The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors...
CVE-2014-8399
The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors...
CVE-2014-8399
The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors...
Default configuration
Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function...
PHPSHE SQL注入
简要描述： 默认配置验证绕过 详细说明： /include/plugin/payway/ebank/Receive.php中 ebankmd5 默认为空 ，可以生成sign绕过 include'../../../../common.php'; $cachepayway = cache::get'payway'; $payway = unserialize$cachepayway'ebank''paywayconfig'; $key = $payway'ebankmd5'; //默认为空 $void =trim$POST'void'; $vpmode =trim$POST'vpmode';...
elasticsearch: remote code execution flaw via dynamic scripting
It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...