Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

CVE-2014-8749

CVE-2014-8749 concerns a Server-Side Request Forgery (SSRF) in the BulletProof Security WordPress plugin, affecting admin/htaccess/bpsunlock.php. The vulnerability allows an attacker to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. Affected product/v...

CVE-2014-8749

Server-side request forgery SSRF vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter...

PT-2014-8708

Name of the Vulnerable Software and Affected Versions BulletProof Security plugin versions prior to .51.1 Description A server-side request forgery SSRF issue allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter in the...

Windows Outbound-Filtering Rules

This module makes some kind of TCP traceroute to get outbound-filtering rules. It will try to make a TCP connection to a certain public IP address this IP does not need to be under your control using different TTL incremental values. This way if you get an answer ICMP TTL time exceeded packet fro...

CVE-2014-3464

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

Input validation

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

WS: Incomplete fix for CVE-2013-2133

It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...

Egresser - Tool to Enumerate Outbound Firewall Rules

Egresser is a tool to enumerate outbound firewall rules, designed for penetration testers to assess whether egress filtering is adequate from within a corporate network. Probing each TCP port in turn, the Egresser server will respond with the client’s source IP address and port, allowing the clie...

ZoneAlarm Pro 1.0/2.x Outbound Packet Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3647/info Due to a common design error, it may be possible for outbound packets to bypass packet filtering in many personal firewalls. Many of these applications only block packets created by the standard Windows protocol...

CVE-2014-1643

The Web Email Protection component in Symantec Encryption Management Server aka PGP Universal Server before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL...

CVE-2014-1643

The Web Email Protection component in Symantec Encryption Management Server aka PGP Universal Server before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL...

CVE-2014-1643

Symantec Encryption Management Server (aka PGP Universal Server) Web Email Protection prior to 3.3.2 is vulnerable: an authenticated Web Messenger/Remote user can alter a URL to view another user’s stored outbound emails due to a flaw in Web Email Protection’s access restrictions. Affected versio...

PT-2014-4272

Name of the Vulnerable Software and Affected Versions Symantec Encryption Management Server versions prior to 3.3.2 Description The issue allows remote authenticated users to read stored outbound e-mail messages of arbitrary users via a modified URL. Recommendations For versions prior to 3.3.2,...

Design/Logic Flaw

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated b...

PT-2013-3295

Name of the Vulnerable Software and Affected Versions Open-Xchange Server versions prior to 6.20.7 rev14 Open-Xchange Server versions 6.22.0 prior to rev13 Open-Xchange Server versions 6.22.1 prior to rev14 Description The issue is related to a "Server-side request forging SSRF" problem, where th...

CVE-2013-1648: Improper Input Validation

The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated b...

DEBIAN-CVE-2012-6579

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service loss of e-mail readability, via an e-mail message to a queue's address...