WordPress: plugins.trac.wordpress.org likely vulnerable to Cross Site Tracing (xst), TRACE HTTP method should be disabled

Background A Cross-Site Tracing XST attack involves the use of Cross-site Scripting XSS and the TRACE HTTP method. According to RFC 2616, "TRACE allows the client to see what is being received at the other end of the request chain and use that data for testing or diagnostic information." XST coul...

CVE-2004-2320

The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing XST attacks in applications that are...

CVE-2012-2223

The xplat agent in Novell ZENworks Configuration Management ZCM 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing XST attacks via unspecified vectors...

Cross site scripting

The xplat agent in Novell ZENworks Configuration Management ZCM 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing XST attacks via unspecified vectors...

CVE-2012-2223

The CVE-2012-2223 issue affects Novell ZENworks Configuration Management (ZCM): the xplat agent in ZCM 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which could allow remote attackers to perform cross-site tracing (XST) via unspecified vectors. Impact is stated as poten...

CVE-2012-2223

The xplat agent in Novell ZENworks Configuration Management ZCM 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing XST attacks via unspecified vectors...

http TRACE cross-site attacks a vulnerability test with the defense fix-bug warning-the black bar safety net

From the bad wolf's blog Web Presence: http TRACE cross-site attack vulnerabilities. Scan results: http TRACE cross-site attacks His webserver supports the TRACE and/or TRACK methods. TRACE and TRACK is used to debugweb serverthe connection to the HTTP way. Support the way of a presence Server...

HTTP Cross-Site Tracing Detection

Checks if the host is vulnerable to Cross-Site Tracing XST This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Cross-Site Tracing Detection', 'Description' = 'Checks if the host is vulnerable ...

Design/Logic Flaw

The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing XST attack, a related issue to CVE-2004-2763 and CVE-2005-3398...

CVE-2008-7253

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing XST attack, a related issue to CVE-2004-2763 and...

CVE-2010-0386

The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method. This allows remote unprivileged users to perform a cross-site tracing (XST) attack, which can be used to steal sensitive information such as cookies and authentication credentials from HT...

CVE-2008-7253

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing XST attack, a related issue to CVE-2004-2763 and...

CVE-2004-2763

The Red Hat and SUSE entries for CVE-2010-0386 describe the same class of issue as CVE-2004-2763: default installations of Sun Java System Application Server 7 enable the HTTP TRACE method, enabling cross-site tracing that can expose cookies and credentials. This is a related but distinct advisor...

Microsoft WordPad Word 97 text converter XST buffer overflow

Added: 04/17/2009 CVE: CVE-2008-4841 BID: 32718 OSVDB: 50567 Background The Microsoft WordPad Word 97 text converter allows Windows users who do not have Microsoft Word to open Word 97 files. Problem A buffer overflow vulnerability allows command execution when WordPad is used to open a Word 97...

Microsoft WordPad Word 97 text converter XST buffer overflow

Added: 04/17/2009 CVE: CVE-2008-4841 BID: 32718 OSVDB: 50567 Background The Microsoft WordPad Word 97 text converter allows Windows users who do not have Microsoft Word to open Word 97 files. Problem A buffer overflow vulnerability allows command execution when WordPad is used to open a Word 97...

Microsoft WordPad Word 97 text converter XST buffer overflow

Added: 04/17/2009 CVE: CVE-2008-4841 BID: 32718 OSVDB: 50567 Background The Microsoft WordPad Word 97 text converter allows Windows users who do not have Microsoft Word to open Word 97 files. Problem A buffer overflow vulnerability allows command execution when WordPad is used to open a Word 97...

Microsoft WordPad Word 97 text converter XST buffer overflow

Added: 04/17/2009 CVE: CVE-2008-4841 BID: 32718 OSVDB: 50567 Background The Microsoft WordPad Word 97 text converter allows Windows users who do not have Microsoft Word to open Word 97 files. Problem A buffer overflow vulnerability allows command execution when WordPad is used to open a Word 97...

CVE-2003-1567

The undocumented TRACK method in Microsoft Internet Information Services IIS 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by usi...

CVE-2007-3008

CVE-2007-3008 affects Mbedthis AppWeb prior to 2.2.2. The vulnerability is that HTTP TRACE is enabled, which can lead to information leakage and cross-site tracing (XST) concerns. This entry is corroborated by related advisories in the connected documents, which note the TRACE method as the root ...

CVE-2007-3008

Mbedthis AppWeb before 2.2.2 enables the HTTP TRACE method, which has unspecified impact probably related to remote information leaks and cross-site tracing XST attacks, a related issue to CVE-2004-2320 and CVE-2005-3398...