105 matches found
Nari PCS-9611 relay input validation vulnerability
Nari PCS-9611 relay is a line protection measurement and control device from China Guodian Nanrui Nari. An input validation vulnerability exists in the Nari PCS-9611 relay. A remote attacker can exploit this vulnerability to arbitrarily read/access system resources...
Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...
CVE-2016-9257
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to...
CVE-2016-9257: Improper Neutralization of Input During Web Page Generation
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to...
PT-2017-10027
Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 12.0.0 through 12.1.2 Description The issue allows non-authenticated users to inject JavaScript into a request, which is then rendered and executed in the context of the Administrative user when viewing the Access System...
MGASA-2017-0063 Updated kernel and kmod packages fixes security vulnerabilities
This kernel update is based on upstream 4.4.50 and fixes at least the following security issues: The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service system hang by leveraging access to a...
Huawei Mobile Phone Retrieval Feature Security Bypass Vulnerability
The huawei Mate 9, P9 are smartphones from the Chinese company Huawei Huawei. The Huawei phones are vulnerable to a security bypass vulnerability in the retrieval feature, which allows an attacker to bypass the phone retrieval and access the phone's system settings page by following specific step...
XSS Cross-Site Scripting Vulnerability and CSRF Vulnerability in OpenPortal Network Access System
OpenPortal network access authentication system supports standard Portal protocol, Portal V1 V2 protocol, CMCC protocol, WISPr protocol and PAP CHAP authentication, widely used in smart communities, smart cities, smart hospitals, plazas, large-scale supermarkets, hotels, tourist attractions,...
FreeBSD : drupal -- multiple vulnerabilities (9393213d-489b-11e5-b8c7-d050996490d0)
Drupal development team reports : This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTM...
drupal -- multiple vulnerabilities
Drupal development team reports: This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTML...
Ammyy Admin 3.2 - Authentication Bypass
No description provided by source. Title: ==== Ammyy Admin - Hidden hard-coded option and Access Control vulnerability. Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ==== - CVE-2013-5581 for hidden hard-coded option...
jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities
Document Title: =============== jDisk stickto v2.0.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1196 Release Date: ============= 2014-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 11...
Transferable Remote 1.1 XSS / LFI / Command Injection
Title: ====== Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities Date: ===== 2013-02-09 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=863 VL-ID: ===== 863 Common Vulnerability Scoring System: ==================================== 8.5 Introduction:...
hobcms / hertzCMS 1.1.9.19 File include Vulnerability
Exploit for php platform in category web applications ===================================================== hobcms / hertzCMS 1.1.9.19 File include Vulnerability ===================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /'...
Fusionphp Fusion News 3.7 - 'index.php' Remote File Inclusion
source: https://www.securityfocus.com/bid/19546/info Fusion News is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the...
WebCalendar -- remote file inclusion vulnerability
WebCalendar is proven vulnerable to a remote file inclusion vulnerability. The sendreminders.php does not properly verify the "includedir" parameter, giving remote attackers the possibility to include local and remote files. These files can be used by the attacker to gain access to the system...
Linux Kernel 2.6.x chown() Group Ownership Alteration Exploit
Exploit for linux platform in category local exploits ============================================================= Linux Kernel 2.6.x chown Group Ownership Alteration Exploit ============================================================= / $Id: raptorchown.c,v 1.1 2004/12/04 14:44:38 raptor Exp $...
[SA12853] phpCodeGenie "Simple Application Generation" Code Execution Vulnerability
TITLE: phpCodeGenie "Simple Application Generation" Code Execution Vulnerability SECUNIA ADVISORY ID: SA12853 VERIFY ADVISORY: http://secunia.com/advisories/12853/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: phpCodeGenie 3.x http://secunia.com/product/4141/...
[SECURITY] [DSA-346-1] New phpsysinfo packages fix directory traversal
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 346-1 [email protected] http://www.debian.org/security/ Matt Zimmerman July 8th, 2003 http://www.debian.org/security/faq -...
3com RAS 1500 Configuration Disclosure
The remote 3com SuperStack II Remote Access System 1500 discloses its user configuration usersettings.cfg when the file is requested through the web interface. The file is transmitted in cleartext and contains the password of the device as well as other sensitive information. An attacker may use...