CVE-2014-0053: Undefined Security Weakness

The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT...

PT-2014-4926

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to bypass intended access restrictions via a direct request. Recommendations For versions prior to 7.0....

CVE-2013-6031: Improper Authentication

The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to 1 api/wlan/security-settings, 2 api/device/information, 3...

CVE-2014-0733: Improper Authentication

The Enterprise License Manager ELM component in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494...

PT-2014-1878

Name of the Vulnerable Software and Affected Versions kdelibs versions 4.10.3 and earlier kdelibs versions prior to 4.12.5-r1 Description The issue allows attackers to discover credentials via a crafted request that triggers an internal server error, which includes the username and password in an...

CVE-2013-0340: Improper Restriction of XML External Entity Reference

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

CVE-2013-7224

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

CVE-2013-7249: Exposure of Sensitive Information to an Unauthorized Actor

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224...

CVE-2013-7067: Undefined Security Weakness

The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request...

CVE-2013-6708: Undefined Security Weakness

Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889...

PT-2013-4364

Name of the Vulnerable Software and Affected Versions Cisco Server Provisioner versions 6.4.0 Patch 5-1301292331 and earlier Description The web interface does not require authentication for certain pages, allowing remote attackers to obtain sensitive information via a direct request...

CVE-2013-3407: Undefined Security Weakness

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664...

CVE-2013-3610: Improper Authentication

qis/QISfinish.htm on the ASUS RT-N10E router with firmware before 2.0.0.25 does not require authentication, which allows remote attackers to discover the administrator password via a direct request...

CVE-2013-6011: Improper Input Validation

Citrix NetScaler Application Delivery Controller ADC 10.0 before 10.0-76.7 allows remote attackers to cause a denial of service nsconfigd crash and appliance reboot via a crafted request...

PT-2013-5180

Name of the Vulnerable Software and Affected Versions Eucalyptus versions prior to 3.3.1 Description The issue allows remote attackers to read log files by sending an unspecified request to either the Cluster Controller CC or Node Controller NC component. Recommendations For versions prior to...

CVE-2013-4999: Exposure of Sensitive Information to an Unauthorized Actor

phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and ErrorHandler.class.php...

CVE-2013-4097: Improper Limitation of a Pathname to a Restricted Directory

ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in a -REG-E-OPEN error message...

PT-2013-4850

Name of the Vulnerable Software and Affected Versions DS3 Authentication Server affected versions not specified Description The issue allows remote attackers to obtain sensitive information via a direct request to the ServerAdmin/TestDRConnection.jsp endpoint, which reveals the installation path ...

CVE-2013-1182: Undefined Security Weakness

The login page in the Web Console in the Manager component in Cisco Unified Computing System UCS before 1.02h, 1.1 before 1.11j, and 1.3x allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207...

PT-2013-3416

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.1.11 Moodle versions 2.2.x prior to 2.2.8 Moodle versions 2.3.x prior to 2.3.5 Moodle versions 2.4.x prior to 2.4.2 Description The issue allows remote attackers to obtain sensitive information via an invalid request...