36 matches found
CVE-2017-3185
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...
Information disclosure
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...
Trello: Sessions Token In Get Parameter Request Initiating Websocket Connection
When anyone login into trello.com application then after authentication, application sends session token into get parameter. so attacker can sniffing this session token form web history, proxy history or log cause fully account takeover. HTTP Request : GET...
Cisco Firepower Management Center Information Disclosure Vulnerability (CNVD-2017-11426)
Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. An information disclosure vulnerability exists in Cisco Firepower Management Center that stems from lengthy output in HTTP log files. An attacker could exploit this...
CVE-2015-7929
eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history...
Wing FTP Server v3.2.4 CSRF Vulnerability
No description provided by source. Application: WingFTP Server 3.2.4 maybe earlier versions too Link: http://www.wftpserver.com/ Vulnerability: CSRF Author: Ams Contact: mail: ax330d at gmail dot com site: http://www.0x416d73.name/ 1. About software "Wing FTP server is not only a FTP server. It's...
w3ml cross-site scripting vulnerability
Overview w3ml, a program used to display mailing list logs on the web site, contains a cross-site scripting vulnerability. Impact An arbitrary script could be executed on the user's web browser which may allow an attacker to steal cookie information. Solution None...
WordPress < 2.1.1 Multiple Script Backdoors
The version of WordPress installed on the remote host appears to include a backdoor that allows an unauthenticated, remote attacker to execute arbitrary code on the remote host, subject to the permissions of the web server user id. %NASLMINLEVEL 70300 Tenable Network Security, Inc...
Cross-Site Scripting and Local File Inclusion in Phorum
Some vulnerabilities have been discovered in Phorum, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, and potentially compromise a vulnerable system. 1 Input passed to the "template" parameter in pm.php isn't properly verified,...
Sawmill < 7.1.6 Multiple Vulnerabilities
Binary data 2947.prm...
CVE-2005-1565
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history...
CVE-2005-1565
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history...
CVE-2005-1565
Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history...
CVE-2005-0435
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog...
