CVE-2016-1441

Cisco Cloud Network Automation Provisioner CNAP 1.00 in Cisco Configuration Assistant CCA allows remote attackers to bypass intended filesystem and administrative-endpoint restrictions via GET API calls, aka Bug ID CSCuy77145...

CVE-2016-3649

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...

CVE-2016-3649

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...

Design/Logic Flaw

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests...

SQL Injection Vulnerability in CIMCO DSS-MAX Decision Support System

CIMCO is the world's largest installed base of DNC systems, mainly used for networking communication of CNC machine tools, machine monitoring, etc. CIMCO DSS-Max Server is a DNC/MDC decision support service software, through which you can easily manage the DNC/MDC database. SQL injection...

op5 7.1.9 - Remote Command Execution

Credits: hyp3rlinx + Website: http://hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/OP5-REMOTE-CMD-EXECUTION.txt Vendor: ============ www.op5.com Product: =========== op5 v7.1.9 op5 Monitor is a software product for server, Network monitoring and management based on...

The vulnerabilities of the Cisco Identity Services Engine, a platform for managing network policies, allow attackers to inject arbitrary Web or HTML code.

The Cisco Identity Services Engine’s management platform has multiple vulnerabilities due to the lack of measures taken to protect the website structure. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary Web or HTML code through GET or POST requests...

How I was in the Google collaboration community GWC found the reflection type, a storage type, the DOM type of vulnerability? - Vulnerability warning-the black bar safety net

! Google for Work Connect, the GWC is a System, Application Administrator, and partner community of system, but also in Google's vulnerability reward range. Shortly before, I was in the GWC community system found reflection type, a storage type, the DOM typeXSS. The storage typeXSS In the GWC...

CVE-2015-7929

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

Design/Logic Flaw

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

CVE-2015-7929

eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...

Cisco FireSIGHT Management Center GET Request Information Disclosure Vulnerability

Cisco FireSIGHT Management Center enables centralized management of network security and operational functions for Cisco ASA with FirePOWER Services and Cisco FirePOWER devices. An information disclosure vulnerability exists in Cisco FireSIGHT Management Center GET requests. A remote attacker cou...

HackerOne: Limited CSRF bypass.

Hello team I have found an very limited CSRF which could be valid for GET requests only. And the Integrations Tab is can be used in bypass Description : Effected url :-...

X2Engine 4.2 - Cross-Site Request Forgery

X2Engine 4.2 - Cross-Site Request Forgery Source: https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-5075/ Details: It was discovered that no protection against Cross-site Request Forgery attacks was implemented, resulting in an attacker being able to...

phpFileManager 0.9.8 Remote Command Execution

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILEMANAGER0728.txt Vendor: ================================ phpfm.sourceforge.net Product: ================================ phpFileManager version 0.9.8 Vulnerability Type:...

Information disclosure

The XMLAPI in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079...

CVE-2015-0595

The XMLAPI in Cisco WebEx Meetings Server 1.5.1.131 and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079...

Cisco WebEx Meetings Server XMLAPI Vulnerability

A vulnerability in the XML application programming interface API of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability is due to improper sanitization of return messages. An attacker could exploit this vulnerability by...

Bookfresh: Reflected XSS on www.bookfresh.com/index.html?view=upload_form

The issue is in the view uploadform. Description When you show an upload form in the site you use an URL like this: https://www.bookfresh.com/index.html?standalone=1&e=0c551a759eb62ba457d017569617eaa8&bk=FFFFFF&view=uploadform And you show the value of the parameter bk in the page: body...

HP Network Virtualization storedNtxFile Directory Traversal (CVE-2014-2625)

A directory traversal vulnerability exists in HP Network Virtualization software. The vulnerability is due to insufficient input validation of user parameters passed to "storedNtxFile" method. A remote, unauthenticated attacker can leverage this vulnerability to gain access to sensitive informati...