685 matches found
USN-2347-1 python-django vulnerabilities
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...
Updated python-django packages fix multiple vulnerabilities
Updated python-django and python-django14 packages fix security vulnerabilities: These releases address an issue with reverse generating external URLs CVE-2014-0480; a denial of service involving file uploads CVE-2014-0481; a potential session hijacking issue in the remote-user middleware...
Code injection
The Accounts tab in the administrative user interface in McAfee Web Gateway MWG before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors...
CVE-2014-0483
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
PYSEC-2014-7
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
CVE-2014-0483
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
Ipswitch WhatsUp Professional 2006 Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based administrative interface of t...
ZaireWeb Solutions Newsletter ZWS Administrative Interface Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/10605/info Newsletter ZWS is reported prone to an administrative interface authentication bypass vulnerability. The vulnerability exists due to a design error in the implementation of the authentication system for the...
Sambar Server 5.x/6.0/6.1 Server Referer XSS
No description provided by source. source: http://www.securityfocus.com/bid/13722/info Sambar Server administrative interface does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing...
Macromedia JRun 4.0 build 61650 Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/9112/info A number of cross-site scripting vulnerabilities have been reported for Macromedia Jrun, specifically in the administrative interface. The problem is said to occur due to insufficient sanitization of URI...
Video Cam Server 1.0 Administrative Interface Authentication Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13459/info Video Cam Server is prone to an authentication bypass vulnerability. This vulnerability exists because Video Cam Server fails to control access to the administrative interface. http://www.example.com/admin.html...
GetSimple CMS 3.3.1 - Persistent Cross Site Scripting
No description provided by source. Exploit Title: etSimple CMS v3.3.1 Persistent Cross Site Scripting Google Dork: N/A Date: 24-03-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://get-simple.info/ Software Link: http://get-simple.info/download/ Version: v3.3.1 Tested on: N/A CVE :...
Ruslan Communications <Body>Builder SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5008/info Ruslan Communications BodyBuilder is a tool designed to assist a user in creating a website. It allows for remote administration through a web interface, and is implemented in Java. Reportedly, user input suppli...
atmail email server appliance 6.4 - Stored XSS - csrf - rce
No description provided by source. Exploit Title: Atmail Email Server Appliance 6.4 Remote Code Execution Date: Jul 21 2012 Author: muts Version: Atmail Email Server 6.4 By sending an email to a user with the Atmail administrative interface open, we can call a remote JavaScript file that will...
PHPWCMS 1.4.5 r398 Cross Site Request Forgery Vulnerability
No description provided by source. ?php / Exploit Title: PHPWCMS Cross-Site Request Forgery Vulnerability Date: 06/16/2010 Author: Jeremiah Talamantes Software Link: http://phpwcms.googlecode.com/files/phpwcmsr398.zip Version: 1.4.5 r398 Tested on: WinXP SP2 EN on WAMP 2.0 CVE: N/A Jeremiah...
EServ 2.9x Password-Protected File Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3838/info EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems. It is possible to construct a web request which is capable of accessing the contents of password protected...
Seyeon FlexWATCH Network Video Server 2.2 Unauthorized Administrative Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8942/info It has been reported that FlexWATCH Network Video Server may be prone to an access validation error that may allow a remote attacker to gain administrative access to the system. The problem is reported to presen...
FloosieTek FTGatePro 1.22 Mail Server Path Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8527/info FloosieTek FTGatePro Mail Server may disclose its installation path to remote attackers. This information could be useful when mounting further attacks against the system. This issue exists in the web...
LevelOne AMG-2000 2.00.00 Security Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/34760/info LevelOne AMG-2000 is prone to a security-bypass vulnerability. Attackers may exploit this issue to gain access to the administrative interface and internal computers from an outside network. This may aid in...
Working Resources 1.7.x BadBlue Administrative Interface Arbitrary File Access
No description provided by source. source: http://www.securityfocus.com/bid/5276/info BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems. BadBlue does not sufficiently control access to the administrative interface. ...