57 matches found
CVE-2021-29115
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features...
ESRI ArcGIS Enterprise 安全漏洞
ESRI ArcGIS Enterprise is a GIS Geographic Information System based software system from Environmental Systems Research Institute ESRI. The system supports mapping and visualization, analysis, and data management. A security vulnerability exists in Esri ArcGIS Enterprise that could be exploited b...
h1-ctf: [H1-2006 2020] CTF Writeup
Summary: Multiple Vulnerabilities leading to full account takeover and access to restricted functions 1. Information Disclosure 2. Login 2FA Bypass 3. SSRF 4. Hardcoded validation 5. Sensitive information disclosure 6. Privilege Escalation 7. Payments 2FA Bypass through SSRF Steps To Reproduce: 0...
MyBiz MyProcureNet Arbitrary File Upload Vulnerability
MyBiz MyProcureNet is a procurement process automation solution from MyBiz Solutions Malaysia. A security vulnerability exists in MyBiz MyProcureNet version 5.0.0, which originates from an attacker being able to adjust the 'HiddenFieldControlCustomWhiteListedExtensions' parameter and add arbitrar...
Answer My Question 1.3 - Cross-Site Scripting (XSS)
The answer-my-question WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. Host: 10.194.0.44 URL: http://10.194.0.44/wp-content/plugins/answer-my-question/modal.php Parameter: Hidden Field id Payload: "alert1...
Web page security vulnerability detection - hidden field-vulnerability warning-the black bar safety net
Some poorly designed web site system may contain a lot of may be the use of security vulnerabilities, these security vulnerabilities as giving the remote attacker to open a backdoor, so an attacker can easily perform some malicious attack. For example, the Common Vulnerabilities and Exposures...
Moving a subtask Issue Type will sometimes ask the user for a Security Level even though this value is inherited from the Parent Issue.
When you move a subtask from an Issue Type where Security Level is a hidden field, to one where Security Level is no longer hidden, the system can mistakenly ask the User for a new Security Level. This is only a minor issue, as then the subtask will not actually take on the chosen value - it will...
Moving a subtask Issue Type will sometimes ask the user for a Security Level even though this value is inherited from the Parent Issue.
When you move a subtask from an Issue Type where Security Level is a hidden field, to one where Security Level is no longer hidden, the system can mistakenly ask the User for a new Security Level. This is only a minor issue, as then the subtask will not actually take on the chosen value - it will...
IBM Lotus Domino HTML Hidden Field Encrypted Password Disclosure
The remote host is running a version of Lotus Domino Server that is prone to several information disclosure vulnerabilities. Specifically, users' password hashes and other data are included in hidden fields in the public address book 'names.nsf' readable by default by all users. Moreover, Domino...
CVE-2005-2220
Dragonfly Commerce (Dragonfly) is affected by a vulnerability where remote attackers can modify the hidden field x_DragonflyCartProductPrice to alter product prices via several endpoints (dc_Categorieslist.asp, dc_Categoriesview.asp, dc_productslist.asp, dc_productslist_Clearance.asp). The vendor...
PT-2005-3149 · Dragonfly · Dragonfly Commerce
Name of the Vulnerable Software and Affected Versions: Dragonfly Commerce affected versions not specified Description: The issue allows remote attackers to change a product price by modifying the x DragonflyCartProductPrice hidden field in several API endpoints, including "dc Categorieslist.asp",...
ASP.NET __VIEWSTATE crypto validation prone to replay attacks
Good morning, ASP.NET's extremely popular VIEWSTATE functionality provides an automatic, uniform method for storing current state of all webpage "controls" including form fields, database views, etc, so that user-entered data automagically persists and is populated across newly rendered HTML, and...
[SHK-001]Payflow Link Default Config may lead to Hidden Field Modification
Shirkdog Security Advisory SHK-001 Title: ------- Payflow Link Default Config may lead to Hidden Field Modification Description of Application: ------------------------------------ http://verisign.com/products-services/payment-processing/online-payment/payflow-link/index.html careful with the lin...
rpc-everythingform.txt
Hi All, This is Yet Another Bad Perl Script. everythingform.cgi uses a hidden field 'config' to determine where to read configuration data from. --code snippit-- .. $ConfigFile = $inconfig; .. openCONFIG, "$configdir$ConfigFile" || &Error"I can't open $ConfigFile in the ReadConfig subroutine...
CVE-2000-0758
The web interface for Lyris List Manager 3 and 4 allows list subscribers to obtain administrative access by modifying the value of the listadmin hidden form field...
DST2K0036: Price modification possible in CyberOffice Shopping Ca rt
All, We have released this with the permission of the vendor. Rgds Ollie ----- Ollie Whitehouse Security Team Leader tel: +44 020 79160200 ============================================================================ Delphis Consulting Plc...