PT-2015-1953

Name of the Vulnerable Software and Affected Versions Cisco TelePresence TC versions prior to 7.3.4 Description The issue is related to inadequate access control in the Cisco TelePresence TC software, allowing remote attackers to bypass authentication through multiple request parameters...

PhpMyAdmin SERVER Superglobal Remote Variable Manipulation

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

PhpMyAdmin GLOBALS Superglobal Remote Variable Manipulation

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

PhpMyAdmin ENV Superglobal Remote Variable Manipulation (CVE-2010-3065)

A remote variable manipulation vulnerability has been reported in PhpMyAdmin. The vulnerability is due to insufficient validation of request parameters. A remote attacker could exploit this vulnerability by sending a malicious request to the server. Successful exploitation could result in...

CVE-2014-0058

The security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files...

Oracle BPEL Process Manager ScriptServlet Information Disclosure (CVE-2013-3828)

A directory traversal vulnerability has been reported in Oracle BPEL Process Manager. The vulnerability is due to insufficient input validation in ScriptServlet when processing HTTP request parameters. A remote unauthenticated attacker can leverage this vulnerability to obtain sensitive informati...

HP Intelligent Management Center BIMS bimsDownload Information Disclosure (CVE-2013-4823)

An information disclosure vulnerability has been reported in the BIMS add-in module of HP Intelligent Management Center.The vulnerability is due to lack of authentication and insufficient input validation in the bimsDownload servlet when processing HTTP request parameters. Remote attackers can...

struts 2.3.14 includeParams 命令执行漏洞

Apache Struts框架是一个基于Java Servlets,JavaBeans和JavaServer PagesJSP的Web应用框架的开源项目,Struts基于Model-View-ControllerMVC的设计模式,可以用来构件复杂的Web应用.Apache Struts 2.3.14标签库中的url标签和a标签的includeParams这个属性，代表显示请求访问参数的含义，一旦它的值被赋予ALL或者GET或者POST，就会显示具体请求参数内容。可利用此进行命令执行攻击 struts 2.3.14...

HP Intelligent Management Center ReportImgServlet Information Disclosure (CVE-2012-5203)

An information disclosure vulnerability has been reported in HP Intelligent Management Center. The vulnerability is due to lack of authentication and insufficient input validation in the ReportImgServlet servlet when processing HTTP request parameters. By sending crafted HTTP requests to the targ...

Reflected xss in CloneSessionPost.jspa

In plugin/src/main/resources/templates/excalibur/web/testsessions/test-session-clone.vm on line 2, the 'testSessionId' parameter is extracted from the request parameters and inserted without first html encoding the value into the form element 'action' value. This means means that the resource is...

CVE-2009-5031

ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting XSS attacks via a single quote in a request parameter in the Content-Disposition field of a...

CVE-2012-0022

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

CVE-2012-0022: Undefined Security Weakness

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...

PT-2011-5195

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.34 Apache Tomcat versions 6.x through 6.0.33 Apache Tomcat versions 7.x through 7.0.22 Description The issue allows remote attackers to cause a denial of service due to CPU consumption via a request...

tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. d...

Citrix Access Gateway information leak

HTTP session cookie is passed through HTTP GET request parameters, making it possible to leak it value thorugh Referer: field or in the browsing history...

CVE-2007-1605

w-Agora Web-Agora allows remote attackers to obtain sensitive information via a request to rss.php with an invalid 1 site or 2 bn parameter, 3 a certain value of the site parameter, or 4 an empty value of the bn parameter; a request to index.php with a certain value of the 5 site or 6 sort...

LoveCMS 1.4 - step Traversal Arbitrary File Access

LoveCMS 1.4 - step Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22675/info LoveCMS is prone to multiple input-validation vulnerabilities, including an arbitrary-file-upload issue, a remote file-include issue, a local file-include issue, and a cross-site scripting issu...

DLink 514 DHCP crossite scripting

Crossite scripting via DHCP request parameters...

CVE-2002-0769: Undefined Security Weakness

The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an HTTP POST request with a single byte, which allows the attackers to 1 obtain the password from the login screen, or 2 reconfigure the adaptor by modifying...