4591 matches found
Cloudera Manager Unauthenticated configuration download
Cloudera Manager allows to download module configurations without authentication by iterating on the module index integer starting from 1 through the following GET request: http://:7180/cmf/services//client-config This finding may not constitute a vulnerability by itself as: This behaviour can be...
Grab: Private Grab Messages on Android App can be accessed and cached by Search Engines
Description Hello. Today i discovered, that Search Engines can access the private users messages OTP pins, Group invites information etc. It happens because the https://grab-attention.grabtaxi.com host allows search indexing, and can leak the authtoken to the Search Engines which also can lead to...
Null pointer dereference
An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...
CVE-2016-8723
An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...
CVE-2017-7725
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
Design/Logic Flaw
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
CVE-2017-7725
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
CVE-2017-7725
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
PT-2017-9765 · Moxa · Moxa Awk-3131A Wireless Access Point
Name of the Vulnerable Software and Affected Versions: Moxa AWK-3131A Wireless Access Point version 1.1 Description: A null pointer dereference issue exists in the Web Application functionality. Sending an HTTP GET request without a preceding '/' can cause a segmentation fault in the web server. ...
CVE-2017-7725: Improper Neutralization of Input During Web Page Generation
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored...
CVE-2016-8723: NULL Pointer Dereference
An exploitable null pointer dereference exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Any HTTP GET request not preceded by an '/' will cause a segmentation fault in the web server. An attacker can send any of a multitude of potentially...
Moxa MXview < 2.9 Multiple Vulnerabilities (HTTP) - Active Check
Moxa MXview is prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Directory traversal
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. dot dot in a "GET /uir/" request...
CVE-2016-5072: Improper Control of Generation of Code
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...
PT-2017-8688
Name of the Vulnerable Software and Affected Versions OXID eShop versions prior to 5.1.12, 5.2.9, 4.8.12, and 4.9.9 Description The issue allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Recommendations For versions prior to 5.1.12, update to...
PT-2017-2285
Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a cross-site scripting vulnerability in the web console of Kaspersky Anti-Virus 8.0 for Linux File Servers. An attacker can exploit this by sending a specially...
PT-2017-2286
Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus 8.0 for Linux File Servers Description The issue is related to a potential command injection vulnerability in the web console of the antivirus software. This could allow a remote attacker to access a file on the server by...
Disk Sorter Enterprise 'GET' Buffer Overflow Vulnerability
Flexense Disk Sorter Enterprise is a file categorization solution from Flexense USA. The solution supports file classification to disk, directory, network share and NAS storage devices and performs advanced historical trending operations. A buffer overflow vulnerability exists in Disk Sorter...