2145 matches found
CVE-2014-1694
Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...
CVE-2014-0015
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request...
Saia PCD < 1.22 Multiple Vulnerabilities
Saia PCD is prone to a vulnerability in the user authentication. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX =...
CVE-2013-7107
Cross-site request forgery CSRF vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106...
CVE-2013-7107
Cross-site request forgery CSRF vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106...
CVE-2013-7107
CVE-2013-7107 describes a CSRF vulnerability in Icinga’s cmd.cgi that can allow remote attackers to hijack a user’s authenticated session for unspecified commands. Affected versions include Icinga 1.8.5, 1.9.4, 1.10.2 and earlier. The issue is demonstrated by bypassing authentication for CVE-2013...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...
HP SiteScope 'issueSiebelCmd' SOAP请求远程代码执行漏洞
BUGTRAQ ID: 63478 CVECAN ID: CVE-2013-4835 HP SiteScope是无代理监控软件，可维护其分布式IT基础架构的可用性和性能。 HP SiteScope 11.22之前版本在处理"issueSiebelCmd" SOAP请求的实现上存在安全漏洞，成功利用后可导致执行任意代码。 0 HP SiteScope 11.22 厂商补丁： HP -- HP已经为此发布了一个安全公告（HPSBMU02933）以及相应补丁: HPSBMU02933：HP SiteScope, issueSiebelCmd SOAP Request, Remote Code...
By wave CMS General-purpose SQL injection 8+9（select models）-bug warning-the black bar safety net
Brief description: It seems by the waves begin to completely closed-source. Already ready to block everyone decompile, temporarily also don't know is with what method, after the if research out of words to say it. So official don't pull what XXX the source package, not open source is not a shame...
ABB MicroSCADA Wserver Command Execution
A command execution vulnerability has been reported in ABB MicroSCADA. The vulnerability is due to insufficient user authentication by the wserver.exe program when accepting remote execution calls. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary commands on...
cumin: CSRF protection does not work
Multiple cross-site request forgery CSRF vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote attackers to hijack the authentication of cumin users for unspecified requests...
OSX Gather Autologin Password as Root
This module will steal the plaintext password of any user on the machine with autologin enabled. Root access is required. When a user has autologin enabled System Preferences - Accounts, OSX stores their password with an XOR encoding in /private/etc/kcpassword. This module requires Metasploit:...
[SECURITY] Fedora 19 Update: mingw-curl-7.33.0-1.fc19
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...
RUCKUS ADVISORY ID 10282013 - User authentication bypass vulnerability in Ruckus Access Point's administrative web interface
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 10282013 Customer release date: Oct 28, 2013 Public release date: Nov 28, 2013 TITLE User authentication bypass vulnerability in Ruckus Access Point's administrative web interface SUMMARY An user authentication bypass vulnerability...
CVE-2013-5993
Cross-site request forgery CSRF vulnerability in LOCKON EC-CUBE 2.11.0 through 2.13.0 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors related to refusals...
php云人才系统sql注入漏洞
简要描述： 详细说明： index.php?M=qqconnect&C=mcert&id=MScgYW5kIHNsZWVwKDEwKSBhbmQgJzEnPScxfDE0OTA4MTQyfA== 测试 model/qqconnect.class.php function mcertaction $id=$GET'id'; $arr=@explode"|",base64decode$id;//解码 if$id && isarray$arr && $arr0 && $arr2==$this-config'coding'//主要看coding 是配置文件里面的 默认是空 如果修改 echo...
samba: cross-site request forgery vulnerability in SWAT
Cross-site request forgery CSRF vulnerability in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that...
CVE-2013-4555
Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...
TCCMS全版本COOKIE注入（已演示证明）
简要描述： TCCMS teamcen.com Cookie Injection 具体请见详细说明 证明处使用SQLMAP注射成功 详细说明： /public/Class/Authen.class.php 省略无关代码 请注意添加注释处代码，下同 public static function checkUserLogin $Obj = M"user"; if empty$COOKIE'userId' || empty$COOKIE'AuthenId' return false; //下面的语句直接使用$COOKIE'userId'没有过滤 $sql="select password fr...