PT-2011-5089

Name of the Vulnerable Software and Affected Versions Parallels Plesk Small Business Panel version 10.2.0 Description The issue allows remote attackers to obtain sensitive information by reading web-server access logs or web-server Referer logs, related to a "cross-domain Referer leakage" issue...

CVE-2011-4759: Exposure of Sensitive Information to an Unauthorized Actor

Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading 1...

CVE-2011-4138

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

CVE-2011-4138

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

PYSEC-2011-3

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

Design/Logic Flaw

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

PYSEC-2011-3

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

CVE-2011-4138

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

Apache killer exploit modified for better Results

Apache killer exploit modified for better Results "4L4N4 K!LL3R " or Killapache DDOS tool exploit, previously coded by kingscope 's , re-edited and coded by "S4uR4 " , which kills apache and still many websites are vulnerable. S4uR4 rewrite this exploit on php/curl web based with agressive mode...

Killapache: DDOS tool - Half of the Internet is vulnerable now !

Killapache: DDOS tool - Half of the Internet is vulnerable now ! The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing...

Cross site scripting

The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings for 1 Client/frmViewReports.aspx or 2 UserControls/Popups/frmHelp.aspx, which makes it easier for remote attackers to obtain sensitive information by reading a...

CVE-2011-0345

Directory traversal vulnerability in the NMS server in Alcatel-Lucent OmniVista 4760 R5.1.06.03 and earlier allows remote attackers to read arbitrary files via directory traversal sequences in HTTP GET requests, related to the lang variable...

Directory traversal

Directory traversal vulnerability in the NMS server in Alcatel-Lucent OmniVista 4760 R5.1.06.03 and earlier allows remote attackers to read arbitrary files via directory traversal sequences in HTTP GET requests, related to the lang variable...

CVE-2011-0345

CVE-2011-0345 is a directory traversal vulnerability in the NMS server of Alcatel-Lucent OmniVista 4760 (affected: OmniVista 4760 NMS versions 5.0.07.05 and 5.1.06.03 ). The issue allows remote attackers to read arbitrary files via directory traversal sequences in HTTP GET requests, specifically ...

Darkshell Botnets Targeting Chinese Manufacturers With DDoS Attacks

Researchers are tracking a new bot that originated in China and is being used by various associated botnets that are hammering away with DDoS attacks aimed at several dozen targets around the world, including a number of telecom companies and specialized manufacturers. The piece of malware behind...

CGI Generic On Site Request Forgery (OSRF)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings with special characters like dots, slashes, backslashes, equal signs, question marks, etc. By leveraging this issue, an attacker may be able to cause arbitrary GET requests to be executed by a user when he...

Cacti < 0.8.7f Multiple Input Validation Vulnerabilities

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7f. It is, therefore, potentially affected by the following vulnerabilities : - A vulnerability exists in 'templatesexport.php' due to improper validation of input to the...

CA SiteMinder GET请求多个跨站脚本漏洞

BUGTRAQ ID: 36086,36088 CVECAN ID: CVE-2009-2704,CVE-2009-2705 CA SiteMinder是一个集中的Web访问管理系统，允许对Web应用和门户执行用户认证、单点登录、认证管理等功能。 SiteMinder没有正确地过滤用户在GET请求中所提交的参数。如果远程攻击者在提交的请求中包含有%00（编码的空字节）或非规范的超长Unicode的话，就可以绕过对J2EE应用的跨站脚本保护措施。 Computer Associates SiteMinder 厂商补丁： Computer Associates...

XBMC 8.10 (GET Requests) Multiple Remote Buffer Overflow PoC

Exploit for multiple platform in category dos / poc...

CVE-2009-0274

Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to obtain sensitive information via a crafted URL, related to conversion of POST requests to GET requests...