CVE-2019-1645

The CVE-2019-1645 entry corresponds to Cisco Connected Mobile Experiences (CMX) Information Disclosure. Affected component: CMX software; vulnerability arises from lack of input/validation for certain GET requests to APIs on the device. An unauthenticated, adjacent attacker can send HTTP GET requ...

Cisco Connected Mobile Experiences Information Disclosure Vulnerability

A vulnerability in the Cisco Connected Mobile Experiences CMX software could allow an unauthenticated, adjacent attacker to access sensitive data on an affected device. The vulnerability is due to a lack of input and validation checking mechanisms for certain GET requests to API's on an affected...

CSRF Bypass

cfme is vulnerable to CSRF bypass attacks. The vulnerability exists as a number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery CSRF protection...

A vulnerability exists in the backup function of the Cisco Prime Infrastructure network monitoring and management system, which allows a intruder to disclose protected information.

The vulnerability in the backup function of the Cisco Prime Infrastructure monitoring and network equipment management system relates to the transmission of protected information in GET requests. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

XSSFuzzer - A Tool Which Generates XSS Payloads Based On User-Defined Vectors And Fuzzing Lists

XSS Fuzzer is a simple application written in plain HTML/JavaScript/CSS which generates XSS payloads based on user-defined vectors using multiple placeholders which are replaced with fuzzing lists. It offers the possibility to just generate the payloads as plain-text or to execute them inside an...

Directory Traversal in hostr

Affected versions of hostr are vulnerable to directory traversal which allows attackers to read files outside the current directory by sending ../ in the url path for GET requests. Recommendation Upgrade to version 2.3.6 or later...

Mail.ru: SSRF на api.icq.net

SSRF in api.icq.net due to invalid handling of non-zero Content-Length value in GET requests...

D-Link router httpd server directory traversal vulnerability

The DWR-116, DIR-140, and DIR-640 are all D-Link router products. A directory traversal vulnerability exists in the httpd server of several series of D-Link routers, which allows a remote attacker to read arbitrary files via an HTTP request after "GET / uir" followed by / ... or //. or // after...

The vulnerability of the components menu_pxc.cgi and index.cgi of the microprogramming system for controlled switches from FL SWITCH by Phoenix Contact allows a hacker to execute arbitrary code or cause malfunctions during maintenance.

The vulnerability of the components menupxc.cgi and index.cgi of the microprogramming software for controlled switches from FL SWITCH Phoenix Contact arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary...

CVE-2018-16409

In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF...

Server side request forgery (ssrf)

In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF...

CVE-2017-2653

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional...

CVE-2017-2653

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional...

CVE-2017-2653

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional...

rails_admin ruby cross-site request forgery vulnerability

railsadmin ruby is a Rails engine that supports the use of interfaces to manage data. A cross-site request forgery vulnerability exists in versions of railsadmin ruby prior to 1.1.1, which stems from a failure of the Non-GET method to validate a cross-site request forgery token. An attacker could...

CVE-2016-9494

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may...

UBUNTU-CVE-2016-10522

railsadmin ruby gem v1.1.1 is vulnerable to cross-site request forgery CSRF attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem...

Insteon 2864-222 Buffer Overflow Vulnerability (CNVD-2018-12053 )

Insteon HD IP Camera White 2864-222 is an IP camera product from Insteon USA. A buffer overflow vulnerability exists in the webService binary in Insteon HD IP Camera White 2864-222. An attacker can exploit this vulnerability to cause a denial of service with a specially crafted pid, pwd, or usr...

IPConfigure Orchid VMS 2.0.5 Directory Traversal / Information Disclosure

require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote, unauthenticated attacker to send crafted GET requests to the application, which results in th...