AVG Remote Administration Bypass / Code Execution / Static Keys AVG Remote Administration Bypass /

AVG Remote Administration version 13.0.0.2892 suffers from authentication bypass, remote code execution, missing entity authentication, and use of static encryption key vulnerabilities. title: Multiple critical vulnerabilities product: AVG Remote Administration vulnerable version: all - except...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

CVE-2014-3115

Fortinet FortiWeb

CVE-2014-3115

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

AVG Remote Administration Bypass / Code Execution / Static Keys

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: AVG Remote Administration vulnerable version: all - except issue 2 fixed version: none - except issue 2 impact: critical...

CVE-2014-3115: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

Fortiweb 5.1.x Cross Site Request Forgery Vulnerability

FortiWeb versions 5.1.x and below suffer from a cross site request forgery vulnerability. FortiWeb Cross-Site Request Forgery Vulnerability Multiple CSRF vulnerabilities exist in the FortiWeb web administration console due to lack of CSRF token protection. This could allow remote attackers to...

PT-2014-5098

Name of the Vulnerable Software and Affected Versions FortiWeb versions prior to 5.2.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the web administration console. These vulnerabilities allow remote attackers to hijack the authentication of...

Run a Command on Multiple Servers: ClusterSSH

Run a Command on Multiple Servers How to run a command on multiple servers at once? If you maintain multiple Linux servers, there are cases where you want to run the same commands on all the servers. For example, you may want to install/upgrade packages, patch the kernel, and update configuration...

CVE-2013-1803

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the 1 orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a 2 parameter name starting with...

CVE-2013-1803: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the 1 orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a 2 parameter name starting with...

PT-2014-2495

Name of the Vulnerable Software and Affected Versions PHP-Fusion versions prior to 7.02.06 Description The issue allows remote attackers to execute arbitrary SQL commands via various parameters in different PHP files, including the orderby parameter to "downloads.php", and several parameters in...

PYSEC-2014-68

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Netgear DGN2200 Cross Site Scripting

Exploit Title: Stored XSS Vulnerability in NETGEAR DGN2200 Web interface Date 30/04/2014 Exploit author: Dolev Farhi @f1nhack Vendor homepage: http://netgear.com Affected Firmware version: 1.0.0.291.7.29HotS Affected Hardware: NETGEAR DGN2200 Wireless ADSL Router Summary ======= NETGEAR DGN2200...

Cross site scripting

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

CVE-2013-6323

CVE-2013-6323 is a cross-site scripting vulnerability in the Administration Console of IBM WebSphere Application Server (WAS) and WebSphere Virtual Enterprise. It can be exploited by a remote authenticated user via a crafted URL to inject script/HTML into a victim’s browser. Affected WAS versions...

CVE-2013-6323

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

PT-2014-1405

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.32 IBM WebSphere Application Server versions 8.x through 8.0.0.8 IBM WebSphere Application Server versions 8.5.x through 8.5.5.1 WebSphere Virtual Enterprise versions 7.x through...

CVE-2013-6323: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

PT-2014-2499

Name of the Vulnerable Software and Affected Versions PHP-Fusion versions prior to 7.02.06 Description The issue allows remote attackers to obtain sensitive information by requesting a backup file directly. This is possible because backup files are stored with predictable filenames in an...