CVE-2015-7570: Server-Side Request Forgery (SSRF)

Multiple server-side request forgery SSRF vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter to libs/org/adodblite/tests/testadodblite.php, libs/org/adodblite/tests/testdatadictionary.php, or...

PT-2017-18106

Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749 Description The issue allows the upgrade process to be requested remotely without authentication. This is achieved through the httpupg.cgi endpoint with a...

CVE-2012-1301: Improper Input Validation

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter...

PT-2017-8692

Name of the Vulnerable Software and Affected Versions CloudView NMS versions prior to 2.10a Description The issue allows remote attackers to obtain sensitive information by making a direct request for the admin/auto.def file. Recommendations For versions prior to 2.10a, update to version 2.10a or...

PT-2017-1530

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions prior to the fixed version Description The issue is caused by an integer overflow in the iSNS Server service, allowing remote attackers to issue malicious requests. Recommendations For Microsoft Windows Server...

CVE-2015-3881: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to 1 core/config/databases.yml, 2 core/log/qdPMprod.log, or 3 core/apps/qdPM/config/settings.yml...

CVE-2016-4950: Exposure of Sensitive Information to an Unauthorized Actor

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions...

CVE-2015-6023: Improper Access Control

ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands...

CVE-2016-10126

Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via...

CVE-2016-9479: Undefined Security Weakness

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request...

Post Indexer 3.0.6.1 Man-In-The-Middle Vulnerability

Post Indexer version 3.0.6.1 suffers from a man-in-the-middle vulnerability that may allow for arbitrary code execution. Details ================ Software: Post Indexer Version: 3.0.6.1 Homepage: http://premium.wpmudev.org/project/post-indexer/ Advisory report:...

CVE-2016-5667: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html...

CVE-2016-1337: Exposure of Sensitive Information to an Unauthorized Actor

Cisco EPC3928 devices allow remote attackers to obtain sensitive configuration and credential information by making requests during the early part of the boot process, related to a "Boot Information Disclosure" issue, aka Bug ID CSCux17178...

CVE-2016-4971: Undefined Security Weakness

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

CVE-2016-2293: Undefined Security Weakness

The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover settings via a direct request to an unspecified URL...

PT-2016-4434

Name of the Vulnerable Software and Affected Versions Eaton Lighting EG2 Web Control versions 4.04P and earlier Description The issue allows remote attackers to read the configuration file, which can lead to the discovery of credentials, by making a direct request. Recommendations For versions...

CVE-2016-0871: Exposure of Sensitive Information to an Unauthorized Actor

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

CVE-2015-6853: Insufficient Verification of Data Authenticity

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

PT-2016-5642

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 5.0.17 and prior Palo Alto Networks PAN-OS versions 6.0.12 and prior Palo Alto Networks PAN-OS versions 6.1.9 and prior Palo Alto Networks PAN-OS versions 7.0.5 and prior Description The issue allows remote...

CVE-2016-0755: Improper Authentication

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015...