Sendio ESP - Information Disclosure

Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of last update: 2015-05-22 Vendors contacted: Sendio...

ManageEngine MSPCentral 9 CSRF / Cross Site Scripting Vulnerability

ManageEngine MSPCentral version 9 suffers from cross site request forgery, insecure session cookies, and cross site scripting vulnerabilities. Multiple vulnerabilities in ManageEngine MSPCentral 9 ------------------------------------------------------------ Background ---------- At Kiwicon 6 in m...

CGI Generic Open Redirection

By providing specially crafted parameters to CGIs, Nessus was able to redirect to a third-party website. As redirections are commonly used, it is possible that users will be unaware that something abnormal is happening. This kind of attack can be used to steal confidential data, typically...

CGI Generic Local File Inclusion (2nd pass)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to include a local file and disclose its contents, or even execute arbitrary code on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities

Exploit for unknown platform in category remote exploits ================================================================ Profense Web Application Firewall 2.6.2 XSRF/XSS Vulnerabilities ================================================================ Written By Michael Brooks Special thanks to...

Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery / Cross-Site Scripting

Written By Michael Brooks Special thanks to str0ke! Affects: Profense Web Application Firewall XSRF and XSS Version: 2.6.2 download http://www.armorlogic.com/downloadsoftware.html "Defenses against all OWASP Top Ten vulnerabilities" Too bad it doesn't defend its self against all of these...

Web Server Transmits Cleartext Credentials

The remote web server contains several HTML form fields containing an input of type 'password' which transmit their information to a remote web server in cleartext. An attacker eavesdropping the traffic between web browser and server may obtain logins and passwords of valid users. C Tenable Netwo...