CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...

CVE-2015-8748

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...

CVE-2016-1134

The CVE-2016-1134 entry documents a Cross-site request forgery (CSRF) vulnerability affecting BUFFALO network devices (e.g., BHR-4GRV2, WEX-300, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300, WMR-433, WSR-1166DHP) with specific firmware versions (e.g., 1.04 and earlier for BHR-4GRV2; 1.90 and earlie...

IBM WebSphere Application Server CSRF Vulnerability (Jan 2016)

IBM WebSphere Application Server is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Online Airline Booking System - Multiple Vulnerabilities

Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an all in one solution for an airline wishing to speed up...

CVE-2015-5990

Cross-site request forgery CSRF vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-7284

CVE-2015-7284 describes a CSRF vulnerability in ZyXEL NBG-418N devices running firmware 1.00(AADZ.3)C0. An attacker can hijack the authentication of arbitrary users via forged requests, potentially executing actions with the victim’s session privileges. Documented impact includes remote attacker ...

How to Configure Device Certificate on Citrix Gateway for Authentication

Adevice certificateverifies that a user device is allowed to connect to the internal network. NetScaler Gateway supports device certificates that enable you to bind the device identity to a public key. Notes : You must install NetScaler Gateway 10.1, Build 120.1316.e or later or 10.5.e.x or 10.5....

CVE-2015-8368

Summary: CVE-2015-8368 affects ntopng (ntop) up to version 2.1.x, where remote authenticated users can escalate privileges by tampering with the login flow. The underlying issue allows changing the login context via the user cookie and the username parameter sent to admin/password_reset.lua, effe...

CVE-2015-6408

Cross-site request forgery CSRF vulnerability in Cisco Unity Connection 11.50.98 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux24578...

HP Operations Orchestration 10.x < 10.22.001 XSRF

The version of HP Operations Orchestration installed on the remote host is 10.x prior to 10.22.001. It is, therefore, affected by a unspecified cross-site request forgery XSRF vulnerability. A remote attacker can exploit this, by tricking a user into following a specially crafted link, to upload...

Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability

Cisco TelePresence Video Communication Server is a telepresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A cross-site request...

sssd security, bug fix, and enhancement update

1.13.0-40 - Resolves: rhbz1270827 - local overrides: don't contact server with overridden name/id 1.13.0-39 - Resolves: rhbz1267837 - sssdbe crashed in ipasrvadacctlookupstep 1.13.0-38 - Resolves: rhbz1267176 - Memory leak / possible DoS with krb auth. 1.13.0-37 - Resolves: rhbz1267836 - PAM...

Redis event a comprehensive analysis-vulnerability warning-the black bar safety net

redis unauthorized access has not been valued, until the 1 1 on No. 4, and in this article on being broke: the redis you can write into the SSH Key and then control the server, the security personnel started a lot of attention to this event. 0×0 1 vulnerability profile Exposed in public of redis ...

ZTE ZXHN H108N R1A ZXV10 W300 Routers - Multiple Vulnerabilities

ZTE ZXHN H108N R1A ZXV10 W300 Routers - Multiple Vulnerabilities Exploit Title: ZTE ZXHN H108N R1A + ZXV10 W300 routers - multiple vulnerabilities Discovered by: Karn Ganeshen CERT VU 391604 Vendor Homepage: www.zte.com.cn Versions Reported ZTE ZXHN H108N R1A - Software version ZTE.bhs.ZXHNH108NR...

Cambium ePMP 1000 Command Injection / Privilege Escalation

July 14, 2015: First contacted Cambium July 14, 2015: Initial vendor response July 16, 2015: Vuln Details reported to Cambium July 31, 2015: Followup on advisory and fix timelines August 03, 2015: Vendor gives mid-Aug as fix v2.5 release timeline. Ceases communication. Nov 19, 2015: Releasing...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Firepower Extensible Operating System 1.11.160 on Firepower 9000 devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux10611...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cisco Prime Collaboration Assurance 10.51 and 10.6 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus62712...

CVE-2015-8082

The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the userlogout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL...

Login Disable - Access Bypass - Moderately Critical - SA-CONTRIB-2015-162

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module doesn't support other contributed user authentication modules like CAS or URL Login. When combined with...