7896 matches found
[Full-disclosure] ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content
Advisory: ActiveWeb Contentserver CMS Clientside Filtering of Page Editor Content RedTeam Pentesting discovered a design vulnerability in the page editor of the activeWeb contentserver CMS during a penetration test. Filtering of user content, e.g. to prevent the usage of Javascript code, is done ...
Cross site request forgery (csrf)
The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...
CVE-2007-3570
The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...
CVE-2007-3570
The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 RC1 allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request...
MySQLDumper Apache访问控制验证绕过漏洞
MySQLDumper是一款备份MySQL数据库的备份脚本。 在Apache访问控制文件中存在配置错误，远程攻击者可以利用漏洞绕过验证删除Apache的访问控制文件，获得对保护文件的访问。 由于MySQLDumper包含的main.php对用户提交的 HTTP POST请求缺少验证，攻击者可以利用漏洞删除.htaccess/.htpasswd文件，访问受保护的文件信息。 MySQLDumper MySQLDumper Typo3-Extension 0.0.5 MySQLDumper MySQLDumper 1.23prereleaseREV MySQLDumper MySQLDumpe...
dreamlog-upload.txt
? / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ / --------------------------------------------------------------------- !...
Inout Search Engine (all version) Remote Code Execution Exploit
Exploit for unknown platform in category web applications =============================================================== Inout Search Engine all version Remote Code Execution Exploit =============================================================== !/usr/bin/php -q -d shortopentag=on this is not a...
GLSA-200705-17 : Apache mod_security: Rule bypass
The remote host is affected by the vulnerability described in GLSA-200705-17 Apache modsecurity: Rule bypass Stefan Esser discovered that modsecurity processes NULL characters as terminators in POST requests using the application/x-www-form-urlencoded encoding type, while other parsers used in we...
Sami HTTP Server 2.0.1 POST Request Denial of Service Exploit
No description provided by source. usr/bin/python import socket print "-------------------------------------------------------------------------" print " Sami HTTP Server 2.0.1 POST request Denial of Service" print " url: http://www.karjasoft.com" print " author: shinnai" print " mail:...
Sami HTTP Server 2.0.1 - POST Denial of Service
usr/bin/python import socket print "-------------------------------------------------------------------------" print " Sami HTTP Server 2.0.1 POST request Denial of Service" print " url: http://www.karjasoft.com" print " author: shinnai" print " mail: shinnaiatautisticidotorg" print " site:...
Sami HTTP Server 2.0.1 POST Request Denial of Service Exploit
Exploit for unknown platform in category dos / poc ============================================================= Sami HTTP Server 2.0.1 POST Request Denial of Service Exploit ============================================================= usr/bin/python import socket print...
Sami HTTP Server 2.0.1 - POST Denial of Service
Sami HTTP Server 2.0.1 - POST Denial of Service usr/bin/python import socket print "-------------------------------------------------------------------------" print " Sami HTTP Server 2.0.1 POST request Denial of Service" print " url: http://www.karjasoft.com" print " author: shinnai" print " mai...
Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass
source: https://www.securityfocus.com/bid/23424/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An authenticated attacker can exploit this issue to access services hosted on an affected computer by...
CVE-2007-1788
Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...
Authentication flaw
Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...
CVE-2007-1788
Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...
Authentication flaw
admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request...
CVE-2007-1603
admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request...
flyspray -- authentication bypass
The Flyspray Project reports: Flyspray authentication system can be bypassed by sending a carefully crafted post request. To be vulnerable, PHP configuration directive outputbuffering has to be disabled or set to a low value...