521 matches found
Security Bulletin: Multiple Security Vulnerabilities in Certain GUI Components of IBM Algo Credit Limits.
Summary Abstract: Multiple security vulnerabilities exist in certain GUI components of IBM Algo Credit Limits, namely ACLM Web GUI, PDS Blotter Web GUI, and ACLM Win GUI. Details of each vulnerability and the affected components are set out below. Vulnerability Details DESCRIPTION: Customers who...
Cross site request forgery (csrf)
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized reques...
CVE-2017-8447
An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index' permissions on an index in a cluster, they may be able to issue both delete and index requests against that index...
CVE-2017-4998
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privileged attacker may potentially exploit the vulnerability to execute unauthorized requests on behalf of the victim, using the authenticated...
Cross site request forgery (csrf)
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privileged attacker may potentially exploit the vulnerability to execute unauthorized requests on behalf of the victim, using the authenticated...
CVE-2017-4998
EMC RSA Archer 5.4.1.3, 5.5.3.1, 5.5.2.3, 5.5.2, 5.5.1.3.1, 5.5.1.1 is potentially affected by a cross-site request forgery vulnerability. A remote low privileged attacker may potentially exploit the vulnerability to execute unauthorized requests on behalf of the victim, using the authenticated...
NETGEAR ProSAFE Plus Configuration Utility vulnerable to improper access control
Overview ProSAFE Plus Configuration Utility provided by NETGEAR is a Windows application to configure and manage NETGEAR's ProSAFE Plus and Click Switches. An operator uses the utility to login and configure NETGEAR switches. When the utility is invoked, it starts listening on a certain port for...
Cross site request forgery (csrf)
An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an authenti...
CVE-2016-1551
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip...
cURL and libcurl Unauthorized Operation Vulnerability
CURL is a set of file transfer tools that utilize URL syntax to work at the command line.Libcurl is a free, open source client-side URL transfer library. A security vulnerability exists in cURL and libcurl versions 7.10.6 through 7.41.0 that stems from the program failing to properly reuse NTLM...
FreeBSD : asterisk -- Mitigation for libcURL HTTP request injection vulnerability (7656fc62-a7a7-11e4-96ba-001999f8d30b)
The Asterisk project reports : CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its funccurl.so module the CURL dialplan function, as well as its resconfigcurl.so cURL realtime backend modules. Since Asterisk may be configured to allow for...
[SECURITY] [DSA 3122-1] curl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3122-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 08, 2015 http://www.debian.org/security/faq -...
CVE-2013-4963
Multiple cross-site request forgery CSRF vulnerabilities in Puppet Enterprise PE before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a 1 report, 2 group, or 3 class or possibly have other unspecified impact...
ModSecurity < 2.7.3 XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
According to its banner, the version of ModSecurity installed on the remote host is earlier than 2.7.3. It is, therefore, potentially affected by a file disclosure vulnerability. An improperly configured XML parser could allow untrusted XML entities from external sources to be accepted, thus...
Advanced POWER Web Hosting CSRF
Exploit for php platform in category web applications Exploit Title: Advanced POWER Web Hosting CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/advanced-power-web-hosting-directory-script-php/22752/ Category:: webapps Demo :...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Spacewalk Java site packages aka spacewalk-java 1.2.39 in Spacewalk, as used in the server in Red Hat Network Satellite 5.3.0 through 5.4.1 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content via unspecified vectors...
CVE-2009-3022
CVE-2009-3022 describes a cross-site request forgery vulnerability in bingo!CMS up to version 1.2. The issue could allow an attacker to hijack a logged-in user’s session to perform requests that modify configuration or content. The core impacted component is bingo!CMS (core and likely the 1.2 ser...
CVE-2007-0044
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the 1 FDF, 2 xml, and 3 xfdf AJAX request parameters, following the hash character, aka...
Атака через HTML-формы (HTML form attack)
Можно заставить браузер подписать результат запроса формы на другой сервер по протоколу отличному от HTTP например команды протокола POP3 в порт 110. Данные формы могут содержать скрипты и быть использованы для межсайтового скриптинга...