Firebird: Buffer Overflow

Background Firebird is a multi-platform, open source relational database. Description The vulnerability is caused due to an error when processing requests from remote clients. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of...

IBM Security QRadar Incident Forensics Cross-Site Request Forgery Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software from IBM. The software supports in-depth forensic investigations of suspected malicious network security incidents, and repair network security vulnerabilities. A cross-site request forgery vulnerability...

CVE-2015-4997: Undefined Security Weakness

IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request...

CVE-2015-6484: Undefined Security Weakness

3S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted 1 GET or 2 POST request...

CVE-2015-1943: Undefined Security Weakness

IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...

CVE-2015-4020: Improper Input Validation

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original...

Google Image CSRF Vulnerability & Using it as a Botnet

Exploit for php platform in category web applications / Exploit Title: Google Image CSRF Vulnerability & Using it as a Botnet Exploit Author: C4T Vendor Homepage : http://images.google.com Google Dork: none Tested on: Linux & Windows ====================================================== Google...

CVE-2015-5696: Improper Input Validation

Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service crash via a crafted request...

CVE-2015-5618: Undefined Security Weakness

Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and 1 read or 2 modify a Voice Time Set configuration settings via a request to voice.htm or b UniFinger configuration settings via a request to bf.htm, a different vulnerability than...

CVE-2015-1833: Improper Input Validation

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-4091: Undefined Security Weakness

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2014-8384: Undefined Security Weakness

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

CVE-2015-0113: Exposure of Sensitive Information to an Unauthorized Actor

The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...

CVE-2013-7439: Undefined Security Weakness

Multiple off-by-one errors in the 1 MakeBigReq and 2 SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow...

CVE-2014-5427: Exposure of Sensitive Information to an Unauthorized Actor

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

CVE-2015-2682: Undefined Security Weakness

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml...

CVE-2014-8757: Improper Access Control

LG On-Screen Phone OSP before 4.3.010 allows remote attackers to bypass authorization via a crafted request...

CVE-2014-9197: Missing Authentication for Critical Function

The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request...

CVE-2015-0554: Undefined Security Weakness

The ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

CVE-2014-1908: Exposure of Sensitive Information to an Unauthorized Actor

The error-handling feature in 1 bp.php, 2 videowhisperstreaming.php, and 3 ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error messag...