Yelp: Missing X-Frame-Options header

URL https://staging.seatme.us/ Vulnerability: The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in...

vBulletin 4.x.x visitormessage.php Remote Code Injection Vulnerability

you can get access from vbulletin forum, just inject php code in one file. + My Homepage: black-hg.org / nasirpour.info + Discovered By: Dariush Nasirpour Net.Edit0r + Greeting : Ali Razmjoo - Ehsan Nezami - Arash Shams - Ramin Shahkar and all my freinds bhg...

vBulletin vBSEO 4.x - 'visitormessage.php' Remote Code Injection

Exploit Title: vBulletin 4.x.x 'visitormessage.php' Remote Code Injection Vulnerability + Discovered By: Dariush Nasirpour Net.Edit0r + My Homepage: black-hg.org / nasirpour.info + Date: 2015 27 February + Vendor Homepage: vBulletin.com + Tested on: vBulletin 4.2.2 + Greeting : Ali Razmjoo -...

Cisco Ironport AsyncOS HTTP Header Injection Vulnerability

Cisco Ironport AsyncOS suffers from an HTTP header injection vulnerability. Cisco Ironport AsyncOS HTTP Header Injection Vendor: Cisco Product webpage: http://www.cisco.com Affected versions: Cisco Ironport ESA - AsyncOS 8.0.1-023 Cisco Ironport WSA - AsyncOS 8.5.5-021 Cisco Ironport SMA - AsyncO...

Squid HTTP Header Injection Vulnerability

Squid Cache or Squid for short is a popular proxy server and web caching server software. A vulnerability in Squid's handling of HTTP responses with specially crafted headers allows attackers to exploit the vulnerability for HTTP response splitting attacks...

Cisco Ironport AsyncOS HTTP Header Injection

Cisco Ironport AsyncOS HTTP Header Injection Vendor: Cisco Product webpage: http://www.cisco.com Affected versions: Cisco Ironport ESA - AsyncOS 8.0.1-023 Cisco Ironport WSA - AsyncOS 8.5.5-021 Cisco Ironport SMA - AsyncOS 8.4.0-138 Date: 24/02/2015 Credits: Glafkos Charalambous CVE: CVE-2015-062...

CVE-2015-0624

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

Design/Logic Flaw

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

CVE-2015-0624

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

CVE-2015-0624

Cisco AsyncOS web framework on ESA, SMA, and WSA is vulnerable to an HTTP header injection flaw due to insufficient validation of header values (notably Host/X-Forwarded-Host). A remote attacker can trigger redirects to arbitrary URLs by sending crafted HTTP headers, potentially aided by publicly...

PT-2015-4768

Name of the Vulnerable Software and Affected Versions Cisco AsyncOS affected versions not specified Description The issue concerns a web framework in Cisco AsyncOS that allows remote attackers to trigger redirects via a crafted HTTP header. Recommendations At the moment, there is no information...

CVE-2015-0624: Improper Input Validation

The web framework in Cisco AsyncOS on Email Security Appliance ESA, Content Security Management Appliance SMA, and Web Security Appliance WSA devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and...

CVE-2015-0881

CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response...

CVE-2014-8911

Cross-site scripting XSS vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header...

CVE-2014-8911

Cross-site scripting XSS vulnerability in IBM Content Navigator 2.0.0 and 2.0.1 before 2.0.1.2 FP002 IF003 and 2.0.3 before 2.0.3.2 FP002 allows remote attackers to inject arbitrary web script or HTML via the Accept-Language HTTP header...

PT-2015-4118

Name of the Vulnerable Software and Affected Versions IBM Content Navigator versions 2.0.0 through 2.0.1 before 2.0.1.2 FP002 IF003 IBM Content Navigator versions 2.0.3 before 2.0.3.2 FP002 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML...

Fortinet FortiWeb Multiple Vulnerabilities (FG-IR-13-009)

Fortinet FortiWeb is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:fortinet:fortiweb"; if...

Pivotal Software management plugin CRLF injection vulnerability

Pivotal Software RabbitMQ is a British company Pivotal Software's set of implementation of the Advanced Message Queuing Protocol AMQP open source message broker software. RabbitMQ management is one of the management plug-in . A CRLF injection vulnerability exists in the management plugin for...

OpenSchool Community Edition 2.2 XSS / Access Bypass

Exploit Title: OpenSchool Community Edition version 2.2 Multiple Vulnerabilities Date: 25 January 2015 Exploit Author: Mahendra Vendor Homepage: www.open-school.org Software Link: http://sourceforge.net/projects/fiyo-cms/ Full version demo: http://www.tryopenschool.com Version: 2.2 Tested : Kali...

Square: HTTP Header revealing server information.

Hi Square, - Vulneravility Class: OWASP A5: Security Misconfiguration - Proof of Concept: nc 74.122.190.83 80 GET / HTTP/1.1 host:1.1.1.1 HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: keep-alive Status: 301 Moved Permanently Location: https://squareup.com/ X-Powered-By:...