[ASA-201611-6] tomcat6: proxy injection

Arch Linux Security Advisory ASA-201611-6 ========================================= Severity: Medium Date : 2016-11-02 CVE-ID : CVE-2016-5388 Package : tomcat6 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat6 before version...

SunellSecurity NVR / Camera - Denial Of Service

Exploit for hardware platform in category dos / poc Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web servic...

SunellSecurity NVR Camera - Denial of Service

SunellSecurity NVR Camera - Denial of Service Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web service buff...

SunellSecurity NVR / Camera 1.6.08-09 / 2.0.06-08 Denial Of Service

Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI Date: 11.2.2016 Exploit Author: qwsj Vendor Homepage: https://github.com/qwsj Version: 1.6.08-09 / 2.0.06-08 Tested on: Windows / Linux Bug in CGI scrypt's for develop. Web service buffer overflow and leading to a stop web service,...

F5 Networks BIG-IP : pcregrep in PCRE vulnerability (K05428062)

pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client. CVE-2015-8393 C Tenable Network Security, Inc. The descriptive text an...

CVE-2016-1592

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI...

Design/Logic Flaw

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI...

Code injection

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI...

CVE-2015-0787

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI...

CVE-2015-0787

NetIQ Designer for Identity Manager is affected by an XSS vulnerability in the forgotUser.do CGI, exploitable via the accessMgrDN parameter. Versions prior to 4.5.3 are impacted; remote attackers could inject arbitrary HTML/Script in a user’s context. Remediation: upgrade to version 4.5.3 or late...

CVE-2016-1592

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI...

Important: python-twisted-web

Issue Overview: It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP...

Amazon Linux: Security Advisory (ALAS-2016-722)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2016-731)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2016-725)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2016-746)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AVTECH monitoring product without the need to login to SSRF vulnerability

In the DVR device, Search. the cgi can be accessed directly, Search. cgi is responsible for search and access to the local network of the camera, Search. cgi provides cgiquery function, by setting ip, port and queryb64str three parameters can achieve direct access to the local network of the...

AVTECH monitoring products information disclosure vulnerability

Due to/cgi-bin/nobody directory of the CGI script file run permissions set unreasonable, resulting in not certified the case directly to run this type of vulnerability has been in the plurality of devices appears, FEI news K1 is because the cgi file to perform the access restrictions unreasonable...

Cgiemail Source Code Disclosure Vulnerability

CGIEmail is a WEB-based mail processing system. A source code disclosure vulnerability exists in Cgiemail version 1.6, which allows an attacker to retrieve the source code of a script file e.g., PL, CGI, and BAT from the server by sending a specially crafted request that contains square brackets...

TrendMicro InterScan Web Security Virtual Appliance - Remote Code Execution (Shellshock)

Exploit for hardware platform in category remote exploits !/usr/bin/env python TrendMicro InterScan Web Security Virtul Appliance ================================================== InterScan Web Security is a software virtual appliance that dynamically protects against the ever-growing flood of w...