Session fixation

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2014-2047: Improper Authentication

Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors...

PT-2014-4450

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 6.0.2 Description A session fixation issue allows remote attackers to hijack web sessions when PHP is configured to accept session parameters through a GET request. Recommendations For ownCloud versions prior to 6.0....

Proxmox Mail Gateway 3.1 Cross Site Scripting

I. VULNERABILITY ------------------------- Multiplus XSS in Proxmox Mail Gateway 3.1 II. BACKGROUND ------------------------- Proxmox Mail Gateway helps you protect your business against all email threats like spam, viruses, phishing and trojans at the moment they emerge. The flexible architectur...

PHP Ticket System Beta 1 - get_all_created_by_user.php?id SQL Injection

PHP Ticket System Beta 1 - getallcreatedbyuser.php?id SQL Injection ============================================================== Title ...| PHP Ticket System SQL Injection Version .| BETA1.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....|...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answerid...

Accept Answer URL should be idempotent and accept PUT or POST requests only

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46610. panel Answers currently users a single URL to both accept and un-accept answers: noformat $baseurl/acceptanswer/$answeri...

Updated varnish packages fix CVE-2013-4484 and correct service behaviour

Updated varnish packages fix security vulnerabilities: Varnish before 3.0.5 allows remote attackers to cause a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace characters and no URI CVE-2013-4484. Also, the services have been converted...

ThinkSNS多处GET型CSRF（打包）

简要描述： ThinkSNS多处CSRF（GET型），可造成一定危害 详细说明： 就拿你们的演示站点做了测试（是T3的最新版本） http://demo.thinksns.com/ ------ ThinkSNS最新版本内对于POST请求的来源是进行了判断的 但是ThinkSNS最新版本对于POST和GET请求是不分的，而且GET请求的是可以在网站内用标签发起的，将导致严重的安全问题，我就选取了一些发上来。 漏洞证明： 1）更改个人设置中的隐私设置（通过GET请求实现）...

CFME: GET request CSRF vulnerability

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protectfromforgery mechanism and conduct cross-site request forgery CSRF attacks via a destructive action in a request...

Medium: varnish

Issue Overview: Varnish before 3.0.5 allows remote attackers to cause a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace characters and no URI. varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the lo...

WebPagetest 'file' parameter Local File Disclosure Vulnerability

WebPagetest is prone to local file disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RockMongo Cross Site Scripting and Directory Traversal Vulnerabilities

Rockmongo is prone to cross-site scripting XSS and directory traversal vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Debian DSA-2814-1 : varnish - denial of service

A denial of service vulnerability was reported in varnish, a state of the art, high-performance web accelerator. With some configurations of varnish a remote attacker could mount a denial of service child-process crash and temporary caching outage via a GET request with trailing whitespace...

TP-Link TD-8840t - CSRF Vulnerability

TP-Link TD-8840t is a ADSL2+ Ethernet/USB Modem Router which works with a 24-Mbps downstream connection. Usage Info TP-Link TD-8840t is a ADSL2+ Ethernet/USB Modem Router which works with a 24-Mbps downstream connection. You can easily change the default user's admin password by the default route...

CVE-2013-3923

Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in a GET request...

Directory traversal

Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in a GET request...

CVE-2013-3923

CVE-2013-3923 affects SavySoda WiFi HD Free prior to 7.0. The vulnerability is a directory traversal flaw where an encoded dot-dot slash (..%2f) in a GET request can cause reading of arbitrary files. Root cause: improper validation of path input allowing traversal. Impact: potential exposure of s...

CVE-2013-3923: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in SavySoda WiFi HD Free before 7.0 allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in a GET request...

CVE-2013-3922

Directory traversal vulnerability in Gummy Bear Studios FTP Drive + HTTP Server 1.0.4 and earlier allows remote attackers to read arbitrary files via a ..%2f encoded dot dot slash in a GET request...