253 matches found
CVE-2015-0689: Improper Restriction of Operations within the Bounds of a Memory Buffer
Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743...
Cross site scripting
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...
CVE-2017-12212
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...
CVE-2017-12212
Cisco Unity Connection (v10.5(2) with default config) is affected by a reflected cross-site scripting (XSS) vulnerability in its web framework. The issue arises from insufficient input validation on HTTP GET/POST parameters, allowing an unauthenticated, remote attacker to persuade a user to follo...
Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain...
HTTP Load Generator: hey
hey is a tiny program that sends some load to a web application – ApacheBench ab replacement. hey was originally called boom and was influenced from Tarek Ziade’s tool at tarekziade/boom . Installation go get -u github.com/rakyll/hey Note: Requires go 1.7 or greater. Usage hey runs provided numbe...
CVE-2017-7685
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...
Design/Logic Flaw
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...
CVE-2017-7685: Undefined Security Weakness
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...
CVE-2017-7685
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...
CVE-2017-7685
Apache OpenMeetings 1.0.0 is reported to respond to insecure HTTP methods (PUT, DELETE, HEAD, PATCH). The available connected sources confirm this behavior but do not provide concrete details on root cause, affected versions beyond 1.0.0, exploit scenarios, or remediation steps. No fixes or mitig...
Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain
Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...
Misconfiguration in LIMIT directive of .htaccess file
There are a number of HTTP methods that can be used on a webserver for example OPTIONS, HEAD, GET, POST, PUT, DELETE etc.. Each of these methods perform a different function, and each has an associated level of risk when their use is permitted on the webserver. The directive within Apache's...
Allowed HTTP Methods
There are a number of HTTP methods that can be used on a webserver OPTIONS, HEAD, GET, POST, PUT, DELETE etc.. Each of these methods perform a different function and each have an associated level of risk when their use is permitted on the webserver. By sending an HTTP OPTIONS request and a direct...
Cisco Identity Services Engine Cross-Site Scripting Vulnerability (cisco-sa-20161207-ise1)
Cisco Identity Services Engine ISE contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...
CVE-2016-6026
The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST...
Cisco Web Security Appliance Proxy Restrictions Bypass
According to its self-reported version, the Cisco Web Security Appliance WSA running on the remote host is affected by a security feature bypass vulnerability that allows an unauthenticated, remote attacker to bypass proxy restrictions via improper or malformed HTTP methods. C Tenable Network...
Multiple Cisco Finesse Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in Cisco Finesse could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks. The vulnerabilities are due to improper input validation of certain parameters passed via HTTP GET or POST methods to an affected device. An unauthenticated, remo...
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the Cisco Identity Services Engine ISE Infra Admin UI could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of some parameters passed via HTTP GET or POST methods. An attacker coul...
