1467 matches found
Default configuration
The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses 1 SCP, 2 SFTP, 3 POP3, 4 POP3S, 5 IMAP, 6 IMAPS, 7 SMTP, 8 SMTPS, 9 LDAP, and 10 LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015...
UBUNTU-CVE-2012-6619
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service crash or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read...
shopex 4.8.5 product filter page somewhere without intval lead to injection vulnerabilities-vulnerability warning-the black bar safety net
Relates to version: shopex-single-4.8.5.80603 whether you need to login: no login required Whether the default configuration: is the presence or absence of the use of the code: code Vulnerability details: Product filter price range somewhere not intval result in injection of...
candlepin: insecure authentication enabled by default
Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors...
[NOSQLMap] NoSQLMap-Automated NoSQL Database pwnage
What is NoSQLMap? NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases, as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to...
TPLINK WR740N/WR740ND - Multiple CSRF Vulnerabilities
Exploit for hardware platform in category web applications Exploit Title: TPLINK WR740N Multiple CSRF Vulnerabilities Date: 11/24/2013 Author: SaMaN @samanL33T Vendor Homepage: http://tplink.com Category: Hardware/Wireless Router Firmware Version: 3.16.6 Build 130529 Rel.47286n and below Tested o...
Default configuration
The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...
UBUNTU-CVE-2013-4436
The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...
CVE-2013-4436
The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...
CVE-2013-2102
The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive information diagnostics by accessing the service...
DEBIAN-CVE-2013-0337
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...
CVE-2013-0337
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...
Default configuration
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the 1 access.log and 2 error.log files, which allows local users to obtain sensitive information by reading the files...
CVE-2013-0337
CVE-2013-0337 affects nginx (likely 1.3.13 and earlier) where the default config leaves (1) access.log and (2) error.log world‑readable. This permits local users to read logs and disclose sensitive information. The root cause is insecure log file permissions in the default nginx configuration. Re...
Xymon 4.x File Deletion
Hi, a security vulnerability has been found in version 4.x of the Xymon Systems & Network Monitor tool https://sourceforge.net/projects/xymon/. Impact ------ The error permits a remote attacker to delete files on the server running the Xymon trend-data daemon "xymondrrd". File deletion is done wi...
Default configuration
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...
activemq: DoS by resource consumption via HTTP requests to sample webapp
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service broker resource consumption via HTTP requests...
Default configuration
The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not require authentication, which allows remote attackers to modify the configuration by visiting the Advanced page. NOTE: the vendor has...
Default configuration
The Data Camouflage aka FairCom Standard Encryption algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certai...
CVE-2013-0148
The Data Camouflage aka FairCom Standard Encryption algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certai...