CVE-2012-5498

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection...

CVE-2014-5107: Exposure of Sensitive Information to an Unauthorized Actor

concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to 1 system/basics/editor.php, 2 system/view.php, 3 system/environment/filestoragelocations.php, 4 system/mail/importers.php, 5 system/mail/method.php, 6 system/permissions/filetypes.php, 7...

PT-2014-6221

Name of the Vulnerable Software and Affected Versions EasyCart wp-easycart versions prior to 2.0.6 Description The issue allows remote attackers to obtain configuration information by making a direct request to "inc/admin/phpinfo.php", which calls the phpinfo function. Recommendations For version...

CVE-2013-6766: Improper Authentication

OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENTAUTHENTIC...

CVE-2013-6765: Improper Authentication

OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENTAUTHENTIC, as demonstrated by the ompxmlhandleendelemen...

CVE-2014-1418: Undefined Security Weakness

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

CVE-2014-0130: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...

CVE-2014-0769: Improper Authentication

The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to 1 modify the configuration via a request to the debug service on port 4000 o...

CVE-2014-0053: Undefined Security Weakness

The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT...

PT-2014-4926

Name of the Vulnerable Software and Affected Versions PaperThin CommonSpot versions prior to 7.0.2 PaperThin CommonSpot versions 8.x prior to 8.0.3 Description The issue allows remote attackers to bypass intended access restrictions via a direct request. Recommendations For versions prior to 7.0....

CVE-2013-6031: Improper Authentication

The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to 1 api/wlan/security-settings, 2 api/device/information, 3...

CVE-2014-0733: Improper Authentication

The Enterprise License Manager ELM component in Cisco Unified Communications Manager Unified CM 10.01 and earlier does not properly enforce authentication requirements, which allows remote attackers to read ELM files via a direct request to a URL, aka Bug ID CSCum46494...

PT-2014-1878

Name of the Vulnerable Software and Affected Versions kdelibs versions 4.10.3 and earlier kdelibs versions prior to 4.12.5-r1 Description The issue allows attackers to discover credentials via a crafted request that triggers an internal server error, which includes the username and password in an...

CVE-2013-0340: Improper Restriction of XML External Entity Reference

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XMLSetEntityDeclHandler function, which allows remote attackers to cause a denial of service resource consumption, send HTTP requests to intranet servers, or read arbitrary files via a...

CVE-2013-7224

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json...

CVE-2013-7249: Exposure of Sensitive Information to an Unauthorized Actor

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224...

CVE-2013-7067: Undefined Security Weakness

The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request...

CVE-2013-6708: Undefined Security Weakness

Cisco Cloud Portal 9.4 allows remote attackers to read files of unspecified types via a direct request, aka Bug IDs CSCuj08426 and CSCui60889...

PT-2013-4364

Name of the Vulnerable Software and Affected Versions Cisco Server Provisioner versions 6.4.0 Patch 5-1301292331 and earlier Description The web interface does not require authentication for certain pages, allowing remote attackers to obtain sensitive information via a direct request...

CVE-2013-3407: Undefined Security Weakness

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664...