7436 matches found
Fortinet FortiMail < 4.3.4 / 5.0.0 Multiple XSS
The remote host is running FortiMail prior to 4.3.4 / 5.0.0. It is, therefore, affected by multiple cross-site scripting vulnerabilities due to a failure to sanitize user-supplied input in the web UI. Specifically, flaws exist in the 'ipmask', 'username', 'address', and 'url' parameters of the...
Fortinet FortiOS < 4.3.13 / 5.0.3 Multiple XSRF
The remote host is running FortiOS prior to 4.3.13 / 5.0.3. It is, therefore, affected by multiple cross-site request forgery vulnerabilities in web UI pages because they are not protected by XSRF tokens. An attacker could potentially exploit this vulnerability to hijack an authenticated user's...
NAS4Free Web UI Default Credentials
The NAS4Free web interface on the remote host has the 'admin' user account secured with the default password. A remote, unauthenticated attacker could exploit this to gain administrative access to the web interface, which could allow arbitrary command execution via exec.php. %NASLMINLEVEL 70300 C...
NAS4Free Web UI Detection
Binary data nas4freedetect.nbin...
Cisco Content Security Management Appliance Web UI Default Credentials
It is possible to log into Cisco Content Security Management Appliance's web management console using default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid73301; scriptversion"1.5";...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
Design/Logic Flaw
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors...
CVE-2014-0887
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors...
CVE-2014-0884
CVE-2014-0884 affects IBM Lotus Protector for Mail Security (Admin Web UI) on 2.8.x before 2.8.1-22905. A cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The root cause is not detailed in the provided docum...
PT-2014-3919
Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.8.x through 2.8.0 Description A cross-site request forgery CSRF issue exists in the Admin Web UI, allowing remote authenticated users to hijack the authentication of victims via unknown vectors...
PT-2014-3918
Name of the Vulnerable Software and Affected Versions IBM Lotus Protector for Mail Security versions 2.8.x through 2.8.1-22904 Description A cross-site scripting XSS issue exists in the Admin Web UI, allowing remote authenticated users to inject arbitrary web script or HTML. This can be achieved...
CVE-2014-0884: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-0885: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...
CVE-2014-0887: Improper Neutralization of Special Elements used in an OS Command
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors...
CVE-2014-0886: Improper Neutralization of Special Elements used in an OS Command
The Admin Web UI in IBM Lotus Protector for Mail Security 2.8.x before 2.8.1-22905 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands via unspecified vectors...
Ability Mail Server 2013 - Password Reset CSRF from Stored XSS (Web UI)
Exploit for windows platform in category web applications On one machine Windows Server 2003, install a new instance of AMS with these configurations 1. Primary Domain: hack.local 2. Enable the WebMail Service 3. Domain Name: hack.local 4. Add a User and set Password. In this case I created a use...
Updated nagios package fixes security vulnerability
A flaw was reported and fixed in Nagios, which can be exploited to cause a denial of service. This vulnerability is caused due to an off-by-one error within the processcgivars function, which can be exploited to cause an out-of-bounds read by sending a specially-crafted key value to the Nagios we...
Conceptronic CIPCAMPTIWL 21.37.2.49 Cross Site Request Forgery
Hello List, Here I inform you about an easily exploitable CSRF discovered in Conceptronic cameras CIPCAMPTIWL. General Details Affected Product: Conceptronic camera CIPCAMPTIWL Tested Firmware: 21.37.2.49 Tested Web UI Firmware: 0.61.4.18 Assigned CVE: CVE-2013-7204 CVSSv2 Base Score: 5.8...