CVE-2014-2868

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to modify the flow of execution of ColdFusion code by using an HTTP GET request to set a ColdFusion variable...

Xerox DocuShare SQL Injection

The following request is vulnerable to a SQL injection in the last URI segment: GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1 Host: 172.31.16.194:8080 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:26.0 Gecko/20100101 Firefox/26.0 Accept:...

CVE-2014-2749

The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request...

Cross site request forgery (csrf)

The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request...

CVE-2014-2749

The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request...

McAfee Cloud Identity Manager ExtensionAccessServlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of McAfee Cloud Identify Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within a servlet called ExtensionAccessServlet which contains a directory...

Kemana Directory 'kemana_admin_passwd' Cookie信息泄漏漏洞

Bugtraq ID:66445 Kemana Directory是一款基于WEB的目录服务。 Kemana Directory存在一个安全漏洞，由于'kemanaadminpasswd' cookie存储了用户密码SHA1哈希，允许可进行中间人攻击的攻击者获得密码信息。 0 Kemana Directory 1.5.6 目前没有详细解决方案提供： http://www.c97.net GET /kemana/admin/revreport.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64...

CVE-2013-1605

Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 05.53 allows remote attackers to execute arbitrary code via a long filename in a GET request...

Buffer overflow

Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 05.53 allows remote attackers to execute arbitrary code via a long filename in a GET request...

CVE-2013-1605

Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 05.53 allows remote attackers to execute arbitrary code via a long filename in a GET request...

CVE-2014-2047

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

Session fixation

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2014-2047

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

Proxmox Mail Gateway 3.1 Cross Site Scripting

I. VULNERABILITY ------------------------- Multiplus XSS in Proxmox Mail Gateway 3.1 II. BACKGROUND ------------------------- Proxmox Mail Gateway helps you protect your business against all email threats like spam, viruses, phishing and trojans at the moment they emerge. The flexible architectur...

PHP Ticket System Beta 1 - get_all_created_by_user.php?id SQL Injection

PHP Ticket System Beta 1 - getallcreatedbyuser.php?id SQL Injection ============================================================== Title ...| PHP Ticket System SQL Injection Version .| BETA1.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....|...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answerid...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answeri...

Updated varnish packages fix CVE-2013-4484 and correct service behaviour

Updated varnish packages fix security vulnerabilities: Varnish before 3.0.5 allows remote attackers to cause a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace characters and no URI CVE-2013-4484. Also, the services have been converted...

ThinkSNS多处GET型CSRF（打包）

简要描述： ThinkSNS多处CSRF（GET型），可造成一定危害 详细说明： 就拿你们的演示站点做了测试（是T3的最新版本） http://demo.thinksns.com/ ------ ThinkSNS最新版本内对于POST请求的来源是进行了判断的 但是ThinkSNS最新版本对于POST和GET请求是不分的，而且GET请求的是可以在网站内用标签发起的，将导致严重的安全问题，我就选取了一些发上来。 漏洞证明： 1）更改个人设置中的隐私设置（通过GET请求实现）...

CFME: GET request CSRF vulnerability

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protectfromforgery mechanism and conduct cross-site request forgery CSRF attacks via a destructive action in a request...