Pulse CMS view.php页面跨站请求伪造漏洞

BUGTRAQ ID: 38356 CVE ID: CVE-2010-0992 Pulse是一个Web应用程序开发框架和门户网站搭建解决方案。 Pulse CMS没有执行充分的有效性检查便允许用户通过HTTP请求执行某些操作，如果已登录用户访问了恶意网站就会允许远程攻击者劫持用户的认证，代表该用户执行上传图形或删除文件或创建块等请求。 Pulse CMS Pulse CMS Basic 1.2.3 Pulse CMS Pulse CMS Basic 1.2.2 厂商补丁： Pulse CMS --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Code injection

Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.26 and 8.50.07 allows remote authenticated users to affect integrity via unknown vectors...

Code injection

Unspecified vulnerability in the E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote authenticated users to affect integrity via unknown vectors...

CVE-2010-0860

CVE-2010-0860 affects Oracle Database Core RDBMS components in 9.2.0.8 (and DV variants), 10.1.0.5, 10.2.0.4, and 11.1.0.7. The vulnerability allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to the Create User privilege. The issu...

CVE-2010-0857

Technical details about CVE-2010-0857 are not publicly provided in the supplied documents. The connected sources mention Oracle CPU advisories and general vulnerability groupings but do not specify affected components, vectors, or fixes. Monitor for updates.

CVE-2010-1334

Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in an unspecified directory, a different...

CVE-2010-0993

Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified...

CVE-2010-0625

CVE-2010-0625 concerns the Novell NetWare NWFTPD daemon (NWFTPD.nlm/NWFTPD.NLM) with a stack-based buffer overflow when processing long MKD, RMD, RNFR, or DELE commands. Affected products are NetWare 5.1 through 6.5 SP8, with vulnerable NWFTPD before 5.10.01; the issue allows remote authenticated...

Design/Logic Flaw

Password Server in Apple Mac OS X Server before 10.6.3 does not properly perform password replication, which might allow remote authenticated users to obtain login access via an expired password...

CVE-2010-0535

Dovecot in Apple Mac OS X 10.6 before 10.6.3, when Kerberos is enabled, does not properly enforce the service access control list SACL for sending and receiving e-mail, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2010-0522

CVE-2010-0522 affects Apple Mac OS X Server 10.5.8, where Server Admin fails to correctly determine privileges for users previously in the admin group. The underlying issue allows remote authenticated users to leverage former membership to establish a server connection via screen sharing. The ava...

CVE-2010-0989

Pulse CMS contains a directory traversal vulnerability in delete.php (f parameter) affecting versions prior to 1.2.3. Exploitation allows remote authenticated users to delete arbitrary files on the server via directory traversal sequences. Severity is evidenced as moderately critical in Secunia’s...

CVE-2010-0571

Unspecified vulnerability in Cisco Digital Media Manager DMM 5.0.x and 5.1.x allows remote authenticated users to gain privileges via unknown vectors, and consequently execute arbitrary code via a crafted web application, aka Bug ID CSCtc46008...

CVE-2010-0571

Unspecified vulnerability in Cisco Digital Media Manager DMM 5.0.x and 5.1.x allows remote authenticated users to gain privileges via unknown vectors, and consequently execute arbitrary code via a crafted web application, aka Bug ID CSCtc46008...

CVE-2009-4675

CVE-2009-4675 describes a flaw in the Mole Group Gastro Portal (Restaurant Directory) where admin/admin_info/index.php does not require administrative authentication, enabling remote attackers to change the admin password through an unspecified form submission. The NVD CVSS v2 base score is 7.5 (...

Sagem Routers Remote Authentication Bypass

!/usr/bin/perl Exploit Title: Sagem routers Remote auth bypass Exploit Date: 04/03/2010 Author: AlpHaNiX Software Link: null Version: Sagem Routers F@ST 1200/1240/1400/1400W/1500/1500-WG/2404 Tested on: Sagem F@ST 2404 Code : use HTTP::Request; use HTTP::Headers; use LWP::UserAgent; system'cls';...

Sagem Routers Remote Auth bypass Exploit

Exploit for unknown platform in category web applications ======================================== Sagem Routers Remote Auth bypass Exploit ======================================== !/usr/bin/perl Exploit Title: Sagem routers Remote auth bypass Exploit Date: 04/03/2010 Author: AlpHaNiX Software...

Sagem Routers - Remote Authentication Bypass

Sagem Routers - Remote Authentication Bypass !/usr/bin/perl Exploit Title: Sagem routers Remote auth bypass Exploit Date: 04/03/2010 Author: AlpHaNiX Software Link: null Version: Sagem Routers F@ST 1200/1240/1400/1400W/1500/1500-WG/2404 Tested on: Sagem F@ST 2404 Code : use HTTP::Request; use...

CVE-2009-4658

CVE-2009-4658 affects Xerver HTTP Server 4.32. The issue is a denial-of-service (daemon crash) caused by a non-numeric web port assignment in the management interface. The description notes that this can be leveraged by non-authenticated attackers using CVE-2009-4657. Connected references also de...

CVE-2010-0147

SQL injection vulnerability in the Management Center for Cisco Security Agents 5.1 before 5.1.0.117, 5.2 before 5.2.0.296, and 6.0 before 6.0.1.132 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...