1162 matches found
Use of the referrer header on the error page for Crucible can enable XSS attacks
If the referrer header is manipulated and an error condition is triggered, the user will be displayed the error page in FeCru, which includes the manipulated referrer value on the page as a link. The use of the referrer header value directly as the target of a hyperlink can result in the user...
Jira outputs a stack trace to the screen when an error is encountered
When an error condition is triggered by a user or black-box security scanner such as Acunetix, the system provides an appropriate error page. However, the error page includes the stack trace which the scanner will determine to be a potential Information Disclosure vulnerability because the stack...
Jira outputs a stack trace to the screen when an error is encountered
panel h3. Problem When users are greeted by the error 500 page, they can click on the Request assistance link to expand and see the long stack trace of the error that occurs. The information is not useful to most of the end users but it's not possible to hide it from them. h3. Suggestion To have ...
Jira outputs a stack trace to the screen when an error is encountered
panel h3. Problem When users are greeted by the error 500 page, they can click on the Request assistance link to expand and see the long stack trace of the error that occurs. The information is not useful to most of the end users but it's not possible to hide it from them. h3. Suggestion To have ...
ASUS router drive-by code execution via XSS and authentication bypass
ASUS router drive-by code execution via XSS and authentication bypass ===================================================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/asus-router-auth-bypass.txt Overview -------- Various ASUS routers contai...
Apache Tomcat Server Malicious Request Information Disclosure (CVE-2002-2006; CVE-2002-2007; CVE-2002-2008)
An Information disclosure vulnerability has been reported in Apache Tomcat servers. The vulnerability is due to an error in the way Apache Tomcat handles specially crafted page requests. A remote attacker can exploit this vulnerability by sending crafted requests which will result in Apache Tomca...
ASUS Router Multiple Vulnerabilities
The host is running ASUS Router and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodasusroutersmultvuln.nasl 6663 2017-07-11 09:58:05Z teissa $ ASUS Router Multiple Vulnerabilities Authors: Antu Sanadi Copyright: Copyright C 2014 SecPod, http://www.secpod.com This...
RomPager HTTP Referer Header XSS
The remote RomPager HTTP server is affected by a cross-site scripting vulnerability. The server does not properly sanitize the referer header value when generating a 404 error page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
Apache Struts XWork Error Page Multiple Cross-Site Scripting (CVE-2011-1772)
A Cross-Site Scripting vulnerability has been reported in Apache Struts. The vulnerabilities are due to unsanitized parameters in various automatically generated error pages. A remote attacker can exploit these vulnerabilities by enticing a victim to follow a specially crafted link. Successful...
CVE-2013-4098
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter...
CVE-2013-4098
The CVE-2013-4098 entry concerns DS3 Authentication Server, where ServerAdmin/ErrorViewer.jsp accepts a message parameter that can be used to inject arbitrary error-page text. The public descriptions (NVD, Red Hat, CVE record) repeat this flaw, and an OpenVAS plugin notes DS3 has multiple vulnera...
CVE-2013-4098
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via the message parameter...
OpenDocMan 1.2.6.5 Cross Site Scripting
Exploit Title: OpenDocMan 1.2.6.5 Stored/Reflective XSS Date: 05/04/2013 Exploit Author: drone @dronesec More Exploit Information: Vendor Homepage: http://www.opendocman.com/ Software Link: http://sourceforge.net/projects/opendocman/files/opendocman/1.2.6.5/opendocman-1.2.6.5.zip/download Version...
OpenDocMan 1.2.6.5 - Persistent Cross-Site Scripting
Exploit Title: OpenDocMan 1.2.6.5 Stored/Reflective XSS Date: 05/04/2013 Exploit Author: drone @dronesec More Exploit Information: Vendor Homepage: http://www.opendocman.com/ Software Link: http://sourceforge.net/projects/opendocman/files/opendocman/1.2.6.5/opendocman-1.2.6.5.zip/download Version...
Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/05/2013 01:53 PM, [email protected] wrote: DoS loop, 100 cpu strHdrAcptLangGetItem at errorpage.cc Authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466 c8e74ebd8392fda4788179f9a02bb49337638e7b AKAT-1 Versions: 3.2.5, 3.2.7 This error i...
Squid 3.x Denial Of Service
DoS loop, 100% cpu strHdrAcptLangGetItem at errorpage.cc Authors: 22733db72ab3ed94b5f8a1ffcde850251fe6f466 c8e74ebd8392fda4788179f9a02bb49337638e7b AKAT-1 Versions: 3.2.5, 3.2.7 This error is only triggered when squid needs to generate an error page for example backend node is not responding etc...
Code injection
Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page...
CVE-2012-6469
Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page...
CVE-2012-6469: Exposure of Sensitive Information to an Unauthorized Actor
Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving web script in an error page...
ECShop all version SQL injection 0day-vulnerability warning-the black bar safety net
Thanks owed to the killing of the Black Box Any goods added to the shopping cart fill in your delivery address of that page, there is the region of choice flow. php? step=consignee&directshopping=1 For example, the province select Anhui Wherein the POST data as follows country=1&province=3&city=3...