9318 matches found
samba: clickjacking vulnerability in SWAT
The Samba Web Administration Tool SWAT in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a 1 FRAME or 2 IFRAME element...
samba: cross-site request forgery vulnerability in SWAT
Cross-site request forgery CSRF vulnerability in the Samba Web Administration Tool SWAT in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that...
Moderate: Red Hat Security Advisory: samba3x security and bug fix update
Updated samba3x packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...
CVE-2013-5964
The CVE-2013-5964 entry describes a Cross-site scripting (XSS) vulnerability in the Drupal Flag module (7.x-3.x) prior to 7.x-3.1. The issue occurs on the administration page where remote authenticated users with the Administer flags permission can inject arbitrary web script or HTML through the ...
CVE-2013-5505
Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...
CVE-2013-5505
Cisco SA-20131001-CVE-2013-5505 documents an unauthenticated, remote XSS vulnerability in the Cisco Identity Services Engine (ISE) administration page. The issue stems from insufficient input validation of a parameter, allowing an attacker to inject arbitrary web script or HTML via a malicious li...
PT-2013-5589
Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A cross-site scripting XSS issue exists in an administration page, allowing remote attackers to inject arbitrary web script or HTML via an unspecified parameter...
PT-2013-5888
Name of the Vulnerable Software and Affected Versions Flag module versions 7.x-3.x before 7.x-3.1 Description A cross-site scripting XSS issue exists in the administration page of the Flag module for Drupal, allowing remote authenticated users with the "Administer flags" permission to inject...
CVE-2013-5505: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in an administration page in Cisco Identity Services Engine ISE allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCui30275...
SSL Cipher suites are not configurable
Allow SSL cipher suites to be configured, preferably in the administration panel but at a minimum by editing the config.xml. Currently we are relying on the default cipher suites for jetty which includes some outdated ones that are considered insecure these days. See configuring cipher...
ZeroShell cgi-binkerbynet - Local File Disclosure
ZeroShell cgi-binkerbynet - Local File Disclosure Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here :...
ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure
Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named "kerbynet" interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all url look like this :...
Fedora Update for glpi FEDORA-2013-16601
Check for the Version of glpi OpenVAS Vulnerability Test Fedora Update for glpi FEDORA-2013-16601 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...
[SECURITY] Fedora 20 Update: glpi-0.83.9.1-4.fc20
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
PineApp Mail-SeCure conflivelog.pl Command Injection
A command injection vulnerability exists in PineApp Mail-SeCure. The vulnerability is due to an input validation error in conflivelog.pl of the administration interface. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server. Successful...
[SECURITY] Fedora 19 Update: glpi-0.83.9.1-4.fc19
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
OAuth Administration screen is visible to anonymous users
If anonymous user access is enabled under "Global Permission", user can access to "OAuth Administration" page without the need to log-in. Here is the URL to the page: /plugins/servlet/oauth/view-consumer-info This page display Confluence administrators menu on the sidebar and other information su...
OAuth Administration screen is visible to anonymous users
If anonymous user access is enabled under "Global Permission", user can access to "OAuth Administration" page without the need to log-in. Here is the URL to the page: /plugins/servlet/oauth/view-consumer-info This page display Confluence administrators menu on the sidebar and other information su...
McAfee SmartFilter Administration < 4.2.1.01 Unauthenticated Access to JBOSS RMI (SB10029)
The version of McAfee SmartFilter Administration installed on the remote Windows host is earlier than 4.2.1.01. It is, therefore, potentially affected by a code execution vulnerability. The Remote Method Invocation service can be used without authentication to deploy a malicious .war file. By...
