459 matches found
Cross-site Scripting (XSS)
CakePHP is vulnerable to cross-site scripting XSS attacks. The library does not escape special characters in the URL field, allowing a malicious user to inject and execute arbitrary web script...
Timing Attacks
CakePHP is vulnerable to timing attacks. The library does not compare hashes in constant time, which allows malicious users to use the timing of the request to progressively identify a valid hash...
CVE-2017-6316
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge the former name of NetScaler SD-WAN devices, the cookie name was CAKEPHP rather than CGISESSID...
CVE-2017-6316
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge the former name of NetScaler SD-WAN devices, the cookie name was CAKEPHP rather than CGISESSID...
CVE-2017-6316
CVE-2017-6316 affects Citrix NetScaler SD-WAN devices (including CloudBridge) up to version 9.1.2.26.561201, where a remote attacker can execute arbitrary shell commands as root by abusing a cookie (CGISESSID on NetScaler SD-WAN; CAKEPHP on CloudBridge). The vulnerability arises from insufficient...
CVE-2017-6316: Undefined Security Weakness
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge the former name of NetScaler SD-WAN devices, the cookie name was CAKEPHP rather than CGISESSID...
Citrix CloudBridge - CAKEPHP Cookie Command Injection Vulnerability
Exploit for cgi platform in category web applications POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...
Cross-site Request Forgery (CSRF) Bypass
CakePHP is vulnerable to cross-site request forgery CSRF bypass. Attackers can use the method function to bypass the built-in CSRF security checks...
Citrix CloudBridge - CAKEPHP Cookie Command Injection
Citrix CloudBridge - CAKEPHP Cookie Command Injection POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...
Citrix CloudBridge CAKEPHP Cookie Command Injection
POST /cgi-bin/login.cgi?redirect=/ HTTP/1.1 Host: 10.242.129.149 Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer: https://10.242.129.149/cgi-bin/login.cgi?redirect=/ Cookie: CAKEPHP=sleep 10 Content-Type...
CakePHP Cache Corruption Code Execution (CVE-2010-4335)
A remote code execution vulnerability exists in CakePHP. The vulnerability is due to the way the security component of CakePHP fails to validate user input. A remote attacker can exploit this issue by sending a specially crafted HTTP request...
Debian DLA-835-1 : cakephp security update
Dawid Golunski from legalhackers.com discovered that cakephp, an application development framework for PHP, contains a vulnerability that allows attackers to spoof the source IP address. It would allow them to bypass access control lists, or the injection of malicious data which, if treated as...
[SECURITY] [DLA 835-1] cakephp security update
Package : cakephp Version : 1.3.15-1+deb7u2 CVE ID : CVE-2016-4793 Dawid Golunski from legalhackers.com discovered that cakephp, an application development framework for PHP, contains a vulnerability that allows attackers to spoof the source IP address. It would allow them to bypass access contro...
DLA-835-1 cakephp - security update
Bulletin has no description...
CakePHP Security Bypass Vulnerability (CNVD-2017-01244)
CakePHP is the United States Cake Software Foundation of a MVC-based architecture , open source Web development framework. The framework has a flexible view caching , automatic generation of CRUD code and other features . A security vulnerability exists in the 'clientIp' function in CakePHP 3.2.4...
CVE-2016-4793
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...
DEBIAN-CVE-2016-4793
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...
Design/Logic Flaw
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...
