CVE-2017-1000401

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...

EFS Software Easy File Sharing Web Server vfolder.ghp Stack Buffer Overflow

A buffer overflow vulnerability exists in HTTP GET requests to EFS Software Easy File Sharing Web Server. The vulnerability is due to a failure on properly perform boundary checking on user input. A remote, unauthenticated attacker could exploit this vulnerability by sending a malicious HTTP...

HackerOne: Path traversal leading to limited CSRF on GET requests on two endpoints

Hi team! I've found more endpoints which are vulnerable to the limited CSRF stated in report https://hackerone.com/reports/99708. The endpoints cause a CSRF over GET requests, however, I've been unable to exploit it. The following endpoints are vulnerable to this: Proof of Concept 1. Visit...

CVE-2017-3185

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...

Code injection

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances...

CVE-2017-3111

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances...

Cross-Site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because userform.php is getting userID data from GET requests, allowing the attacker to inject arbitrary code into the form and launch XSS attacks...

Design/Logic Flaw

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended...

Code injection

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests...

CVE-2015-4683

Polycom RealPresence Resource Manager aka RPRM before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests...

CVE-2016-6311

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

CVE-2016-6311

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

Design/Logic Flaw

Get requests in JBoss Enterprise Application Platform EAP 7 disclose internal IP addresses to remote attackers...

PT-2017-10738

Name of the Vulnerable Software and Affected Versions GlassFish Server Open Source Edition version 4.1 Description The issue allows for both authenticated and unauthenticated Directory Traversal, which can be exploited by issuing a specially crafted HTTP GET request. Recommendations For GlassFish...

Phishing Attacks

silverstripe/framework is vulnerable to phishing attacks. Remote attackers can leverage the fact that logins can be performed over GET requests to conduct phishing attacks without the victim knowing...

XSStrike - Fuzz and Bruteforce Parameters for XSS

XSStrike is a python which can fuzz and bruteforce parameters for XSS. It can also detect and bypass WAFs. Installing XSStrike Use the following command to download it git clone https://github.com/UltimateHackers/XSStrike/ After downloading, navigate to XSStrike directory with the following comma...

IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2017-11331)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...