7577 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...
CVE-2016-4494
CVE-2016-4494 affects KMC Controls BAC-5051E routers with firmware prior to E0.2.0.2. The vulnerability is a cross-site request forgery (CSRF) that allows an unauthenticated or remote attacker to hijack a user’s session and read the device’s configuration contents via the web interface. Connected...
PT-2016-5977
Name of the Vulnerable Software and Affected Versions KMC Controls BAC-5051E devices with firmware prior to E0.2.0.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of victims for requests that disclose the contents of a configuration file...
CVE-2016-4494: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file...
Pornhub: [RCE] Unserialize to XXE - file disclosure on ams.upload.pornhub.com
Researcher was able to exploit a serialization error in the SimpleXMLElement class to perform object injection using the callbackUrl parameter. Researcher was successful in achieving the following: SSRF Local file inclusion Limited execution of database commands without output I exploited the...
TYPO3 Form Component Arbitrary File Disclosure Vulnerability (TYPO3-CORE-SA-2016-010)
TYPO3 is prone to arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...
Sierra Wireless AceManager File Disclosure Vulnerability (ICSA-16-105-01) - Active Check
Sierra Wireless AceManager is prone to a file disclosure vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
LimeSurvey 2.05x < 2.06+ Multiple Vulnerabilities
LimeSurvey is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:limesurvey:limesurvey"; if...
Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security, bug fix, and enhancement update
Red Hat OpenShift Enterprise 3.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Ajaxel CMS 8.0 - Multiple Vulnerabilities
Ajaxel CMS 8.0 Multiple Vulnerabilities Vendor: Ajaxel Product web page: http://www.ajaxel.com Affected version: 8.0 and below Summary: Ajaxel CMS is very simple ajaxified CMS and framework for any project needs. Desc: Ajaxel CMS version 8.0 and below suffers from multiple vulnerabilities inlcudi...
Ajaxel CMS 8.0 XSS / CSRF / File Disclosure / SQL Injection
Ajaxel CMS 8.0 Multiple Vulnerabilities Vendor: Ajaxel Product web page: http://www.ajaxel.com Affected version: 8.0 and below Summary: Ajaxel CMS is very simple ajaxified CMS and framework for any project needs. Desc: Ajaxel CMS version 8.0 and below suffers from multiple vulnerabilities inlcudi...
Uber: Information Disclosure on lite.uber.com
Hello, according to your policy https://hackerone.com/uber?viewpolicy=true, you are looking for Local File Disclosure. And lite.uber.com also in scope for your program. request: GET https://lite.uber.com/auth/login HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:42.0...
Webnet CMS 1.2 XSS / File Disclosure / SQL Injection
Exploit Title : Webnet CMS Multiple Vulnerabilities Exploit Author : Persian Hack Team Vendor Homepage : http://www.webnet.ir/ Homepage : http://www.persian-team.ir Date: 2016/04/15 Version : 1.2 POC: 1-LFDLocal File Dislocation Explain : ids Parameter encode base64 Path , you can use...
Arbitrary File Disclosure in Form Component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-010/...
Arbitrary File Disclosure in Form Component
It has been discovered, that TYPO3 Form Component is susceptible to Arbitrary File Disclosure. Component Type: TYPO3 CMS Release Date: April 12, 2016 Vulnerable subcomponent: Form Vulnerability Type: Arbitrary File Disclosure Affected Versions: Versions 6.2.0 to 6.2.19 Severity: High Suggested CV...
CVE-2016-0162
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka “Internet Explorer Information Disclosure Vulnerability.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...
PT-2016-1632
Name of the Vulnerable Software and Affected Versions WildFly versions prior to 10.0.0.Final Description The issue is related to an incomplete blacklist vulnerability in the servlet filter restriction mechanism. This allows remote attackers to read sensitive files in the WEB-INF or META-INF...
WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion
Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-26 Google Dork : inurl:/wp-content/plugins/imdb-widget Vendor Homepage: https://wordpress.org/plugins/imdb-widget/ Tested on: MSWin32 Version: 1.0.8 Vuln file : pic.php...
CVE-2016-1773: Undefined Security Weakness
The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via unspecified vectors...
WordPress Image Export 1.1.0 Plugin - Arbitrary File Disclosure
Exploit for php platform in category web applications Exploit Title: Wordpress image-export LFD Date: 03/21/2016 Exploit Author: AMAR^SHG Vendor Homepage: http://www.1efthander.com Software Link: http://www.1efthander.com/category/wordpress-plugins/image-export Version: Everything is affected...