Centreon web interface command injection

Added: 02/29/2016 Background Centreon is a suite of enterprise monitoring products written in PHP. Problem A command injection vulnerability in the Centreon web interface allows remote attackers to execute arbitrary commands by sending a specially crafted useralias parameter in a POST request. Th...

Centreon web interface command injection

Added: 02/29/2016 Background Centreon is a suite of enterprise monitoring products written in PHP. Problem A command injection vulnerability in the Centreon web interface allows remote attackers to execute arbitrary commands by sending a specially crafted useralias parameter in a POST request. Th...

Centreon web interface command injection

Added: 02/29/2016 Background Centreon is a suite of enterprise monitoring products written in PHP. Problem A command injection vulnerability in the Centreon web interface allows remote attackers to execute arbitrary commands by sending a specially crafted useralias parameter in a POST request. Th...

Centreon web interface command injection

Added: 02/29/2016 Background Centreon is a suite of enterprise monitoring products written in PHP. Problem A command injection vulnerability in the Centreon web interface allows remote attackers to execute arbitrary commands by sending a specially crafted useralias parameter in a POST request. Th...

CVE-2016-1297: Improper Neutralization of Special Elements used in an OS Command

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

PT-2016-4690

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine ACE 4710 A5 versions prior to A53.1 Description The issue allows remote authenticated users to bypass intended Role-Based Access Control RBAC restrictions. This is achieved by executing arbitrary Command-Line...

QIWI: Content Spoofing in mango.qiwi.com

Доброй ночи. Уязвимость найдена по адресу: https://mango.qiwi.com/partner/dashboard Уязвимый параметр: partnerfirstname Exploit Code: POST Запрос: POST /partner/signup HTTP/1.1 Host: mango.qiwi.com Connection: keep-alive Content-Length: 515 Cache-Control: max-age=0 Accept:...

Cisco Small Business 500 Wireless Access Point Time Setting Vulnerability

The Cisco Small Business 500 Wireless Access Point is a wireless access point product that provides high-capacity wireless LAN and guest access services, among other features. A security vulnerability in the Cisco Small Business 500 Wireless Access Point allows a remote attacker to set the system...

ManageEngine Firewall Analyzer 8.5 SQL Injection

================================================================ ManageEngine Firewall Analyzer 8.5 SQL Query Execution Vulnerability ================================================================ Description : Vulnerability Type : ManageEngine Firewall Analyzer 8.5 SQL Query Execution...

CVE-2016-1334

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

Design/Logic Flaw

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

CVE-2016-1334

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

CVE-2016-1334

CVE-2016-1334 affects Cisco Small Business 500 Series Wireless Access Point devices running firmware 1.0.4.4. Root cause: insufficient validation of parameters in HTTP POST handling, enabling remote attackers to set the system time via a crafted POST request. Impact stated as integrity disruption...

webSPELL SQL Injection Vulnerability

webSPELL is a WEB-based content management program. A SQL injection vulnerability exists in webSPELL. Input passed to the "/cashbox.php" script via the "payid" HTTP POST parameter is not sufficiently filtered, allowing an attacker to query the application's database and execute arbitrary SQL...

CVE-2016-1334: Improper Input Validation

Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457...

PT-2016-4717

Name of the Vulnerable Software and Affected Versions Cisco Small Business 500 Wireless Access Point version 1.0.4.4 Description The issue allows remote attackers to set the system time via a crafted POST request. Recommendations For version 1.0.4.4, consider restricting access to the system time...

CVE-2016-0882

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Xxe

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2016-0882

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 are vulnerable to a XML External Entity (XXE) issue. The vulnerability enables remote authenticated users to read arbitrary files by sending a POST request containing an XML external entity declaration combined w...

Netgear Management System NMS300 Arbitrary File Upload Vulnerability

The Netgear Management System NMS300 is a network management system for diagnosing, controlling and optimizing network devices. A security vulnerability in Netgear Management System NMS300 allows remote attackers to submit a special POST request to upload arbitrary files...