215 matches found
PT-2019-14030 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.864 Description: The issue allows an attacker to obtain a victim's session file name from /home/USERNAME/tmp/session/sess xxxxxx and the victim's token value from /usr/local/cwpsrv/logs/access log. With this...
Atlassian Jira Information Disclosure Vulnerability (CNVD-2019-32344)
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in AccessLogFilter in Atlassian Jira versions prior to 8.4.0, which can be...
CentOS Control Web Panel 0.9.8.840 User Enumeration Vulnerability
Exploit for linux platform in category web applications Exploit Title: CWP CentOS Control Web Panel User Enumeration Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.836 to 0.9.8.840 Tested on: CentOS...
CentOS-WebPanel.com Control Web Panel 0.9.8.840 User Enumeration
Exploit Title: CWP CentOS Control Web Panel User Enumeration Date: 23 July 2019 Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage: https://control-webpanel.com/ Version: 0.9.8.836 to 0.9.8.840 Tested on: CentOS 7.6.1810 Core CVE : CVE-2019-13385...
WP Slimstat <= 4.8 - Unauthenticated Stored XSS from Visitors
This vulnerability allows a visitor to inject arbitrary JavasScript code on the plugin access log functionality, which is visible both on the plugin’s access log page and on the admin dashboard index—‚ the default page shown once you log in...
H2O H2O WebServer Heap Buffer Overflow (CVE-2018-0608)
A heap buffer overflow vulnerability has been reported in H2O web server. The Vulnerability is due to insufficient input validation when writing to the access log. A remote, unauthenticated attacker can trigger this vulnerability by sending a crafted message to the target server. Successful...
Cross-Site Scripting (XSS)
Apache Geronimo is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into log files via the time parameter or any invalid parameters to cal2.jsp. The injected Javascript executes on the victim's browser when the log files are viewed through the...
H2O vulnerable to buffer overflow
Overview H2O is open source web server software. H2O contains a buffer overflow vulnerability CWE-119 due to a processing flaw in the output of Access Log. Marlies Ruck of ForAllSecure reported this vulnerability to Kazuho Oku, and Kazuho Oku reported this vulnerability to IPA to notify users of...
JVN#93226941: H2O vulnerable to buffer overflow
H2O is open source web server software. H2O contains a buffer overflow vulnerability CWE-119 due to a processing flaw in the output of Access Log. Impact A remote attacker may be able to cause a denial-of-service DoS condition or may execute arbitrary code. Solution Update the Software Update to...
WebLog Expert Enterprise 9.4 - Denial of Service
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-DENIAL-OF-SERVICE.txt + ISR: Apparition Security Vendor: ======= www.weblogexpert.com Product: ========= WebLog Expert Web Server...
CVE-2017-1000401
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...
Default credentials
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...
CVE-2017-1000401
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...
CVE-2017-1000401
CVE-2017-1000401 affects Jenkins versions 2.73.1 and earlier, and 2.83 and earlier, where the default form control used GET for validation requests. This could cause secrets (e.g., API keys) to be logged in HTTP access logs in non-default configurations. The issue has been mitigated by changing ...
JVN#84182676: Multiple vulnerabilities in H2O
H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS...
CVE-2017-1000401
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation e.g. for API keys. The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations o...
Catalyst Mahara Mobile Information Disclosure Vulnerability
Catalyst Mahara Mobile is a suite of mobile social networking software from Catalyst IT in New Zealand. A security vulnerability exists in versions of Catalyst Mahara Mobile prior to 1.2.1, which stems from the program sending passwords in clear text to the access log. An attacker could exploit t...
CVE-2017-1000171
Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text...
