EMC Data Protection Advisor < 6.4.130 Hardcoded Password Vulnerability

According to its self-reported version number, the EMC Data Protection Advisor running on the remote host is 6.3.x prior to 6.3 patch 67 or 6.4.x prior to 6.4 patch 130. It is, therefore, affected by a default credential vulnerability due to hardcoded passwords with the Apollo System Test,...

CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

Cross site request forgery (csrf)

Cross-site request forgery in the REST API in IPython 2 and 3...

CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

DEBIAN-CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

PYSEC-2017-47

Cross-site request forgery in the REST API in IPython 2 and 3...

UBUNTU-CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

CVE-2015-5607

Cross-site request forgery in the REST API in IPython 2 and 3...

CVE-2015-5607: Cross-Site Request Forgery (CSRF)

Cross-site request forgery in the REST API in IPython 2 and 3...

Dynamic Application Security Test Orchestration: Webbreaker

Build functional security testing, into your software development and release cycles! WebBreaker provides the capabilities to automate and centrally manage Dynamic Application Security Testing DAST as part of your DevOps pipeline. WebBreaker truly enables all members of the Software Security...

WordPress REST API Plugin Information Disclosure (CVE-2017-5487)

An information disclosure vulnerability exists in WordPress REST API Plugin. Successful exploitation could result in the disclosure of sensitive user information...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

CVE-2017-14337

When MISP before 2.4.80 is configured with X.509 certificate authentication CertAuth in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access ...

CVE-2017-14337: Improper Authentication

When MISP before 2.4.80 is configured with X.509 certificate authentication CertAuth in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access ...

PT-2017-13399

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.80 Description The issue arises when MISP is configured with X.509 certificate authentication in conjunction with an external user management ReST API. If this API returns an empty value for an external user providin...

Caldera Forms <= 1.5.4 - Authenticated Cross-Site Scripting (XSS)

Version 1.5.4 and earlier of Caldera Forms is vulnerable to a reflected cross-site scripting vulnerability in the "edit" parameter, which is not properly escaped before being printed in an HTML attribute. An attacker can use this to craft URLs that, when clicked, result in malicious JavaScript...

Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...

HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation

This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer overflow in the Connection HTTP header handling by the web server. Exploiting this vulnerability gives full access to the REST API, allowing arbitrary accounts creation. Module Options msf use...