Twiki Perl 4.x, 5.x, 6.x Upload Bypass / Code Execution Vulnerabilities

The debugenableplugins request parameter in Twiki versions 4.x, 5.x, and 6.0.0 allows arbitrary Perl code execution and suffer from a file upload bypass vulnerability. This is an advisory for TWiki administrators: The debugenableplugins request parameter allows arbitrary Perl code execution...

twiki -- remote Perl code execution

TWiki developers report: The debugenableplugins request parameter allows arbitrary Perl code execution. Using an HTTP GET request towards a TWiki server, add a specially crafted debugenableplugins request parameter to TWiki's view script typically port 80/TCP. Prior authentication may or may not ...

CVE-2014-4728

The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 with firmware before 140916 allows remote attackers to cause a denial of service crash via a long header in a GET request...

Cross site request forgery (csrf)

The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router TL-WDR4300 with firmware before 140916 allows remote attackers to cause a denial of service crash via a long header in a GET request...

SENKAS Kolibri Webserver GET Request Buffer Overflow (CVE-2014-4158)

A stack buffer overflow vulnerability has been reported in SENKAS Kolibri Webserver 2.0. The vulnerability is due to a boundary error when handling GET request. A remote unauthenticated attacker can exploit the service by sending a crafted GET request to the target service...

WWW File Share Pro v7.0 - Denial of Service Vulnerability

Document Title: =============== WWW File Share Pro v7.0 - Denial of Service Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1310 Video: http://www.vulnerability-lab.com/getcontent.php?id=1309 http://cwe.mitre.org/data/definitions/121.html...

BF and XSS vulnerabilities in Zyxel P660RT2 EE

Hello 3APA3A! These are Brute Force and Cross-Site Scripting vulnerabilities in Zyxel P660RT2 EE ADSL Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Zyxel P660RT2 EE. ZyNOS Firmware Version: V3.40 AXN.1. This model with other firmware...

ArticleFR CMS 'id' Parameter SQL Injection Vulnerability

ArticleFR CMS is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ManageEngine Password Manager MetadataServlet.dat SQL Injection Exploit

This Metasploit module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to...

WordPress Slider Revolution Arbitrary File Download Vulnerability

WordPress Slider Revolution is prone to an arbitrary file download vulnerability SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine Desktop Central / Password Manager Pro / IT360 SQL Injection

ManageEngine Desktop Central, Password Manager Pro, and IT360 suffer from remote blind SQL injection vulnerabilities. Metasploit module included. TL;DR CVE-2014-3996 / CVE-2014-3997 Blind SQL injection in ManageEngine Desktop Central, Password Manager Pro and IT360 including MSP versions Scroll t...

WordPress dsIDXpress IDX Plugin Cross Site Scripting Vulnerability

WordPress dsIDXpress IDX Plugin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Kolibri WebServer HTTP GET Request Handling Buffer Overflow

Added: 08/07/2014 CVE: CVE-2014-4158 BID: 68195 OSVDB: 108090 Background SENKAS Kolibri Webserver is a free very simple web server for Microsoft Windows that supports serving static web content. Problem Kolibri Webserver is vulnerable to a stack buffer overflow as a result of failure to properly...

CVE-2014-4927

Buffer overflow in ACME microhttpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service crash via a long string in the URI in a GET request...

Buffer overflow

Buffer overflow in ACME microhttpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service crash via a long string in the URI in a GET request...

Kolibri WebServer 2.0 - GET Request SEH Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title : Kolibri WebServer 2.0 Get Request SEH Exploit Exploit Author : Revin Hadi S Date : 14/07/2014 Vendor : http://www.senkas.com Version : 2.0 Tested on : Windows XP SP2 Eng, Windows Server 2003 Eng, Win 7 SP1 E...

BitDefender Products HTTP Daemon < 5.1.11.432 Directory Traversal Vulnerability - Active Check

BitDefender is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Kolibri Web Server 2.0 - GET (SEH)

!/usr/bin/python Exploit Title : Kolibri WebServer 2.0 Get Request SEH Exploit Exploit Author : Revin Hadi S Date : 14/07/2014 Vendor : http://www.senkas.com Version : 2.0 Tested on : Windows XP SP2 Eng, Windows Server 2003 Eng, Win 7 SP1 Eng import socket, sys help = """Kolibri WebServer 2.0 Get...

Envoy: Too much sensitive information in GET https://signwithenvoy.com/device_config/preview_badge

The page was loaded from a URL containing a query string:...

WebBBS Pro 1.18 - GET Request Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7890/info A vulnerability has been discovered in WebBBS Pro, which may allow a remote attacker to trigger a denial of service condition in the WebBBS HTTP server. It has been reported that a remote attacker may cause the...