9809 matches found
Squiz CMS 11654 File Path Traversal Vulnerability
Exploit for php platform in category web applications ======= Summary ======= Name: Squiz CMS - File Path Traversal Release Date: 30 November 2012 Reference: NGS00330 Discoverer: Robert Ray Vendor: Squiz Vendor Reference: 11846 Systems Affected: Squiz CMS V11654 Risk: High Status: Published...
[SECURITY] Fedora 17 Update: openstack-glance-2012.1.2-2.fc17
OpenStack Image Service code-named Glance provides discovery, registratio n, and delivery services for virtual disk images. The Image Service API server provides a standard REST interface for querying information about virtual d isk images stored in a variety of back-end stores, including OpenSta...
Sql injection
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...
CVE-2012-4949
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service...
PT-2012-5683 · Esri · Esri Arcgis
Name of the Vulnerable Software and Affected Versions: ESRI ArcGIS version 10.1 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. This can be achieved by accessing specific API endpoints, such as a...
JIRA REST API makes it easy to harvest email addresses
The JIRA REST API makes it easy to harvest email addresses as an anonymous user. 1. Go to https://jira.atlassian.com/browseJRA-22053 as anonymous. Note that you can't extract email addresses from this page unless the user has used an email address as her username. 2. Now go to...
JIRA REST API makes it easy to harvest email addresses
The JIRA REST API makes it easy to harvest email addresses as an anonymous user. 1. Go to https://jira.atlassian.com/browseJRA-22053 as anonymous. Note that you can't extract email addresses from this page unless the user has used an email address as her username. 2. Now go to...
JIRA REST API makes it easy to harvest email addresses
The JIRA REST API makes it easy to harvest email addresses as an anonymous user. 1. Go to https://jira.atlassian.com/browseJRA-22053 as anonymous. Note that you can't extract email addresses from this page unless the user has used an email address as her username. 2. Now go to...
IBM WebSphere Commerce Enterprise REST服务安全限制绕过漏洞
BUGTRAQ ID: 55684 CVE ID: CVE-2012-3298,CVE-2012-3300 IBM WebSphere Commerce Enterprise 是业界领先的电子商务解决方案。 IBM WebSphere Commerce v7.0.0.0 - 7.0.0.5存在安全漏洞，成功利用后可允许远程攻击者绕过某些安全限制并执行未授权操作。 1 REST服务框架内存在错误，可被利用非法访问资源。 2）处理持久会话和个性化ID时存在错误，可被利用消耗系统资源并显示服务不可用。 0 IBM WebSphere Commerce Enterprise 7.0.0.0 -...
CVE-2012-3298
Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors...
Design/Logic Flaw
Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors...
CVE-2012-3298
Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors...
CVE-2012-3298
CVE-2012-3298 affects IBM WebSphere Commerce 7.0 Feature Pack 4 REST services framework. The vulnerability enables remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors; CVSS v2 base score reported as 5.0 (vector AV:N/AC:L/Au:N/C:N/I:P...
Reflected XSS within the username parameter of the /user/non-system/{username} rest resource
The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...
Reflected XSS within the username parameter of the /user/non-system/{username} rest resource
The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...
Reflected XSS within the username parameter of the /user/non-system/{username} rest resource
The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...
Information disclosure in REST API
REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...
Information disclosure in REST API
REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...
Information disclosure in REST API
REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...