233 matches found
UBUNTU-CVE-2014-0473
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
Avatars appear on Activity Stream even for anonymous users
Every user, independent of privileges, is able to see entries related to user's avatar change on Activity Stream. It also happens for users that are not logged in. See attached image...
JSON-RPC API allows anonymous content rendering
The renderContent method can be used by anonymous users, leaking information, and allowing macro execution. Should the entire JSON-RPC be inaccessible to anonymous users if anonymous users can't use confluence?...
Design/Logic Flaw
Unspecified vulnerability in the Views Bulk Operations module 6 before 6.x-1.10 for Drupal allows remote authenticated users with user management permissions to bypass intended access restrictions and delete anonymous users user 0 via unspecified vectors...
Kuwait Government will suspend Twitter accounts of Anonymous Users
Kuwait Government will suspend Twitter accounts of Anonymous Users In Kuwait, the Ministry of Interior is in the process of enforcing a rule of their own on Twitter which prevents Kuwaiti users from using anonymous accounts. The ministry said in a press statement that such measure comes in order ...
plone -- Remote Security Bypass
Plone developer reports: This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still ...
CVE-2003-1596
NWFTPD.nlm before 5.03.12 in the FTP server in Novell NetWare does not properly restrict filesystem use by anonymous users with NFS Gateway home directories, which allows remote attackers to bypass intended access restrictions via an FTP session...
citrix-enum-apps-xml NSE Script
Extracts a list of applications, ACLs, and settings from the Citrix XML service. The script returns more output with higher verbosity. Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline,...
SA-CONTRIB-2009-074- Webform - Multiple vulnerabilities
Cross-site scripting The Webform module enables the creation of custom forms for collecting data from users. The Webform module does not properly escape field labels in certain situations. A malicious user with permission to create webforms could attempt a cross-site scripting XSS attack when...
Microsoft IIS 5.0/6.0 FTP Server (Stack Exhaustion) Denial of Service
No description provided by source. MS IIS FTPD DoS ZER0DAY There is a DoS vulnerability in the globbing functionality of IIS FTPD. Anonymous users can exploit this if they have read access to a directory!!! Normal users can exploit this too if they can read a directory. Example session where the...
Microsoft IIS FTPd Denial Of Service
MS IIS FTPD DoS ZER0DAY There is a DoS vulnerability in the globbing functionality of IIS FTPD. Anonymous users can exploit this if they have read access to a directory!!! Normal users can exploit this too if they can read a directory. Example session where the anonymous user has read access to t...
Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service
MS IIS FTPD DoS ZER0DAY There is a DoS vulnerability in the globbing functionality of IIS FTPD. Anonymous users can exploit this if they have read access to a directory!!! Normal users can exploit this too if they can read a directory. Example session where the anonymous user has read access to t...
Microsoft IIS 5.06.0 FTP Server - Stack Exhaustion Denial of Service
Microsoft IIS 5.06.0 FTP Server - Stack Exhaustion Denial of Service MS IIS FTPD DoS ZER0DAY There is a DoS vulnerability in the globbing functionality of IIS FTPD. Anonymous users can exploit this if they have read access to a directory!!! Normal users can exploit this too if they can read a...
Microsoft IIS 5.0/6.0 FTP Server (Stack Exhaustion) Denial of Service
Exploit for unknown platform in category dos / poc ===================================================================== Microsoft IIS 5.0/6.0 FTP Server Stack Exhaustion Denial of Service ===================================================================== MS IIS FTPD DoS ZER0DAY There is a DoS...
Microsoft IIS FTPd NLST stack overflow
Microsoft IIS FTPd NLST stack overflow The Microsoft IIS FTPd service may be vulnerable to a stack overflow via the NLST command. On Microsoft IIS 5.x this vulnerability can be used to gain remote SYSTEM level access, whilst on IIS 6.x it has been reported to result in a denial of service. Whilst...
SA-2007-031 - Drupal core - SQL Injection possible when certain contributed modules are enabled
The function taxonomyselectnodes directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomyselectnodes, this is a weakness in Drupal core. Several contributed modules, such as taxonomymenu, ajaxLoader, and ubrowse...
PT-2007-6950 · Invensys · Invensys Wonderware Intouch
Name of the Vulnerable Software and Affected Versions: Invensys Wonderware InTouch version 8.0 Description: The issue allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs due to insecure permissions set on a NetDDE share. Recommendations: For Invensys...
Recently updated links for users with personal spaces link to profile if personal space is not accessible
Users without the global access right for personal space can still see links to personal spaces in the "Recently updated" list on their dashboard. This is a serious security problem for extranets, when one wants to prevent non anonymous external users to see who's using the wiki. Note: this probl...