VM Turbo Operations Manager 4.5.x Directory Traversal

Product: VM Turbo Operations Manager Vendor: VM Turbo Vulnerable Versions: 4.5.x earlier Tested Version: 4.0 Advisory Publication: April 11, 2014 Vendor Notification: April 11, 2014 Public Disclosure: May 8, 2014 Vulnerability Type: Directory Traversal Discovered and Provided: Jamal Pecou Securit...

Apache Tomcat Manager - Application Upload (Authenticated) Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 /Apache.Coyote|Tomcat/ CSRFVAR = 'CSRFNONCE=' include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo =...

Apache Tomcat Manager Code Execution Exploit

This Metasploit module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets var...

CVE-2014-0674: Improper Authentication

Cisco Video Surveillance Operations Manager VSOM does not require authentication for MySQL database connections, which allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a client system with a crafted host nam...

PT-2014-3769

Name of the Vulnerable Software and Affected Versions Cisco Video Surveillance Operations Manager VSOM affected versions not specified Description The issue allows remote attackers to obtain sensitive information, modify data, or cause a denial of service by leveraging network connectivity from a...

Cisco Video Surveillance Operations Manager Unauthenticated Access to Camera Video Feeds Vulnerability

A vulnerability in the administrative web interface of the Cisco Video Surveillance Operations Manager could allow an unauthenticated, remote attacker to view camera video feeds. The vulnerability is due to incomplete enforcement of authentication requirements. An attacker could exploit this...

CVE-2013-3417

The CVE-2013-3417 issue affects Cisco Video Surveillance Operations Manager’s administrative web interface, where improper authentication allows unauthenticated remote access to video feeds via a crafted URL (Bug CSCtg72262). Affected component: the admin web UI; root cause: incomplete enforcemen...

PT-2013-4374

Name of the Vulnerable Software and Affected Versions Cisco Video Surveillance Operations Manager affected versions not specified Description The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication. This allows remote attackers to...

CVE-2013-3417: Improper Authentication

The administrative web interface in Cisco Video Surveillance Operations Manager does not properly perform authentication, which allows remote attackers to watch video feeds via a crafted URL, aka Bug ID CSCtg72262...

CVE-2013-5488: Improper Input Validation

Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS, Cisco Security Manager, Cisco Unified Service Monitor, and Cisco Unified Operations Manager, does not properly interact with the ActiveMQ component, which allows remote attackers to cause a denial of service memory...

VMware vCenter Operations Manager Arbitrary File Upload (VMSA-2012-0013)

The version of vCenter Operations Manager installed on the remote host is earlier than 5.0.3. It is, therefore, potentially affected by an arbitrary file upload vulnerability in the Apache Struts component. By exploiting this flaw, a remote, unauthenticated attacker could overwrite arbitrary file...

CVE-2013-3439

Cross-site scripting XSS vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified HTTP header field, aka Bug ID CSCud80182...

Cross site scripting

Cross-site scripting XSS vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified HTTP header field, aka Bug ID CSCud80182...

CVE-2013-3439

The CVE-2013-3439 issue affects Cisco Unified Operations Manager and is described as an HTTP header injection vulnerability that permits cross-site scripting (XSS) via a crafted URL. The root cause is improper validation of application URLs in the web interface, enabling an unauthenticated or rem...

CVE-2013-3440

Cisco Unified Operations Manager’s administrative web interface contains multiple XSS vulnerabilities (CVE-2013-3440) due to improper input validation and weak cookie protections. An unauthenticated, remote attacker could lure a user to a crafted URL to execute arbitrary script or hijack sessions...

CVE-2013-3439

Cross-site scripting XSS vulnerability in Cisco Unified Operations Manager allows remote attackers to inject arbitrary web script or HTML via a crafted URL in an unspecified HTTP header field, aka Bug ID CSCud80182...

CVE-2013-3440

Multiple cross-site scripting XSS vulnerabilities in the administrative web interface in Cisco Unified Operations Manager allow remote attackers to inject arbitrary web script or HTML, and obtain improperly secured cookies, via unspecified vectors, aka Bug ID CSCud80186...

Cisco Unified Operations Manager Cross-Site Scripting Vulnerability

Vulnerabilities in the administrative web interface of Cisco Unified Operations Manager could allow an unauthenticated, remote attacker to execute cross-site scripting attacks or hijack user sessions. The vulnerabilities are due to a failure to properly validate user supplied input as well as...

Sql injection

SQL injection vulnerability in the management application in Cisco Unified Operations Manager allows remote authenticated users to execute arbitrary SQL commands via an entry field, aka Bug ID CSCud80179...

PT-2013-4395

Name of the Vulnerable Software and Affected Versions Cisco Unified Operations Manager affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the administrative web interface. These vulnerabilities allow remote attackers to inject...