Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability

The Cisco Secure Access Control Server Solution Engine is a Cisco Secure Access Control Server solution engine. A cross-site request forgery vulnerability exists in the Dashboard page of the Cisco Secure Access Control Server Solution Engine monitoring-and-report segment, which allows a remote...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Outlook Web App OWA ...

Cisco Secure Access Control Server Open Redirect Vulnerability

Cisco Secure ACS Access Control Server is a multifunction AAA authentication server. An open redirection vulnerability exists in Cisco Secure Access Control Server, which allows a remote attacker to redirect a user to an arbitrary website with an unspecified parameter and conduct a phishing attac...

CVE-2014-9104

Multiple cross-site request forgery CSRF vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 disconnecting established VPN sessions, 2 connect to arbitrary VPN...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 disconnecting established VPN sessions, 2 connect to arbitrary VPN...

CVE-2014-9104

CVE-2014-9104 covers CSRF vulnerabilities in the XML-RPC API of the OpenVPN Access Server Desktop Client (versions up to 1.5.6). The issues allow an attacker to hijack administrator authentication and perform actions via crafted API requests, including disconnecting VPN sessions, connecting to ar...

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure (Metasploit)

Microsoft Exchange - IIS HTTP Internal IP Address Disclosure Metasploit Exploit Title: Microsoft Exchange IIS HTTP Internal IP Disclosure Vulnerability Google Dork: NA Date: 08/01/2014 Exploit Author: Nate Power Vendor Homepage: microsoft.com Software Link: NA Version: Exchange OWA 2003, Exchange...

Microsoft Exchange Client Access Server Information Disclosure

The Microsoft Exchange Client Access Server CAS is affected by an information disclosure vulnerability. A remote, unauthenticated attacker can exploit this vulnerability to learn the server's internal IP address. An attacker can send a crafted GET request to the Web Server with an empty host head...

OpenVPN Access Server CSRF

XML-RPC interface CSRF...

OpenVPN Warns Customers of CSRF Bug in Access Server Desktop Client

OpenVPN is advising users of its Desktop Client to upgrade as soon as possible to avoid attacks against a CSRF vulnerability that can allow remote code execution. The vulnerability lies in a product that the company no longer supports and considers obsolete. An attacker could exploit the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users...

CVE-2013-2692

OpenVPN Access Server before 1.8.5 is affected by a CSRF vulnerability in the Admin web interface that can allow an attacker to hijack the authentication of administrators and perform actions to create new administrative users. The issue is described as a cross-site request forgery affecting the ...

CVE-2013-2692

Cross-site request forgery CSRF vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users...

ZPanel 10.0.0.2 Remote Command Execution Vulnerability

ZPanel version 10.0.0.2 suffers from a remote root command execution vulnerability. One of our expert team members email protected who is assigned to do the security audit of ZPanel code has found the follwoing security vulnerability with ZPanel 10.0.0.2 which will allow anyone to escalate the ro...

Default Password (openvpnas) for 'root' Account

The account 'root' on the remote host has the password 'openvpnas'. An attacker may leverage this issue to gain administrative access to the affected system. Note that OpenVPN Access Server virtual appliances are known to use these credentials to provide complete, administrative access to the...

Symantec pcAnywhere Access Server Remote Detection

Detection of Symantec pcAnywhere Access Server. The script sends a connection request to the server and attempts to extract the response. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Heap overflow

Heap-based buffer overflow in Foxit Remote Access Server aka WAC Server 2.0 Build 3503 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151...

CVE-2008-7225

Heap-based buffer overflow in Foxit Remote Access Server aka WAC Server 2.0 Build 3503 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151...

CVE-2008-7225

Foxit Remote Access Server (WAC Server) 2.0 Build 3503 is affected by a heap-based buffer overflow that can be triggered by long SSH packets, allowing remote attackers to crash the service or potentially execute arbitrary code. The issue is identified as CVE-2008-7225 and is noted as distinct fro...

CVE-2008-7225

Heap-based buffer overflow in Foxit Remote Access Server aka WAC Server 2.0 Build 3503 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via long SSH packets, a different vulnerability than CVE-2008-0151...