CVE-2015-9331

The CVE-2015-9331 flaw affects the WordPress plugin WP All Import, specifically versions up to 3.2.3 (CVE references also note

CVE-2015-9331

The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit...

The vulnerability in the web interface of the Cisco IOS XE operating system allows a hacker to perform arbitrary actions in the context of the current user.

The vulnerability of the Cisco IOS XE operating system’s web interface is related to the lack of authentication for the requests being executed. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on behalf of the current user, using a specially crafted link...

CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...

PT-2019-5257

Name of the Vulnerable Software and Affected Versions Atlassian Crowd versions 2.1.0 through 3.0.4 Atlassian Crowd versions 3.1.0 through 3.1.5 Atlassian Crowd versions 3.2.0 through 3.2.7 Atlassian Crowd versions 3.3.0 through 3.3.4 Atlassian Crowd versions 3.4.0 through 3.4.3 Atlassian Crowd Da...

CVE-2019-11076

Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request...

CVE-2019-8990

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances...

Authorization

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances...

PT-2019-19293 · Tibco · Tibco Activematrix Businessworks

Name of the Vulnerable Software and Affected Versions: TIBCO ActiveMatrix BusinessWorks versions up to and including 6.4.2 Description: The HTTP Connector component of TIBCO ActiveMatrix BusinessWorks contains an issue that allows unauthenticated HTTP requests to be processed by the BusinessWorks...

DEBIAN-CVE-2019-3804

It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash...

The vulnerability of the Cisco Unified Intelligence Center software’s web interface allows a perpetrator to perform arbitrary actions on the vulnerable device.

The vulnerability of the Cisco Unified Intelligence Center software’s web interface is related to the lack of authentication for HTTP requests. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions on a vulnerable device with user privileges, as long as the user clic...

CVE-2019-6447

The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to...

ZOHO ManageEngine OpManager Privilege Bypass Vulnerability

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. A privilege bypass vulnerability exists in versions prior to ZOHO ManageEngine OpManager 12.3 Build 123196, which stems from the program's failure to authenticate /oputilsServlet requests, an...

CVE-2018-3918

An exploitable vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated messages to SmartThings' remote servers, which incorrectly handle camera IDs for the 'sync'...

Server side request forgery (ssrf)

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks...

CVE-2018-12678

Portainer prior to 1.18.0 is vulnerable: an unauthenticated request to the websocket /websocket/exec endpoint with an unvalidated id parameter can bypass access restrictions and enable server-side request forgery (SSRF). Public Red Hat/CNVD/OSV/etc. entries corroborate the vulnerability; remediat...

Security Bulletin: IBM TRIRIGA Application Platform Cross Site Request Forgery Vulnerability (CVE-2016-0348)

Summary Unauthenticated requests can be made to a vulnerable web application, which then performs unauthorized action on behalf of the attacker. Vulnerability Details CVEID: CVE-2016-0348 DESCRIPTION: IBM Tririga is vulnerable to cross-site request forgery, caused by improper validation of...

DEBIAN-CVE-2018-11469

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 if cache enabled allows attackers to achieve information disclosure via an unauthenticated remote request, related to the protohttp.c checkrequestforcacheability function...

ceph: Unauthenticated malformed HTTP requests handled by rgw_civetweb.cc:RGW::init_env() can lead to denial of service

A NULL pointer dereference flaw was found in RADOS Gateway HTTP request handling when using the Civetweb native webserver. An unauthenticated attacker could crash RADOS Gateway server by sending malicious HTTP requests...

DEBIAN-CVE-2018-6532

An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted authenticated and unauthenticated requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer...