DEBIAN-CVE-2020-27304

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mghandleformrequest API. Web applications that use the file upload form handler, and use parts of the user-controlled...

Fedora: Security Advisory for curl (FEDORA-2021-eb5b7c53a9)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for curl (FEDORA-2020-6af1dd2936)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Formphish - Auto Phishing Form-Based Websites

Auto Phishing form-based websites. This tool can automatically detect inputs on html form-based websites to create a phishing page. Features: Auto detect device Port Forwarding by Ngrok IP Tracker Legal disclaimer: Usage of Formphish for attacking targets without prior mutual consent is illegal...

[SECURITY] Fedora 29 Update: curl-7.61.1-12.fc29

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Password Field With Auto-Complete

In typical form-based web applications, it is common practice for developers to allow autocomplete within the HTML form to improve the usability of the page. With autocomplete enabled default, the browser is allowed to cache previously entered form values. For legitimate purposes, this allows the...

Dell SonicWALL Secure Mobile Access SMA 8.1 - Cross-Site Scripting / Cross-Site Request Forgery

Dell SonicWALL Secure Mobile Access SMA 8.1 XSS And WAF CSRF Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/secure-mobile-access/ Affected version: 8.1 SSL-VPN Summary: Keep up with the demands of today’s remote workforce. Enable secure mobile access to critical apps and...

The vulnerability of the Windows operating system, which allows a perpetrator to trigger a service failure

The vulnerability of the authentication mechanism based on forms in the ADFS component of the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures using specially...

How to Force Enterprise Manager Login to Use Form-Based Authentication

Article Applicability This article applies to Veeam Backup & Replication 12.x and older, as in those versions, the default was for Veeam Backup Enterprise Manager to utilize a Windows Authentication pop-up key="useWindowsAuth" value="true". Starting in Veeam Backup Enterprise Manager v13, the...

KLA10752 Denial of service vulnerability in Microsoft Acrtive Directory Federation Services

Lack of input data checks was found in Microsoft Active Directory Federation Services. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed input to form-based authentication. Original advisories...

Fiyo CMS 2.0_1.9.1 - SQL Injection

Exploit Title: Fiyo CMS multiple SQL vulnerability Date: 2015-06-28 Exploit Author: cfreer poc-lab Vendor Homepage: http://www.fiyo.org/ Software Link: http://tcpdiag.dl.sourceforge.net/project/fiyo-cms/Fiyo%202.0/fiyocms2.0.2.zip Version: 2.01.9.1 Tested on: Apache/2.4.7 Win32 CVE : CVE-2015-393...

Ruby Web Applications Vulnerability Scanner: Yasuo

Ruby Web Applications Vulnerability Scanner Yasuo is a ruby script that scans for vulnerable 3rd-party web applications While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us ...

Web Application Security Scanner Framework: Arachni

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications. It is free, with its source code public and available for review. It is multi-platform, supporting all major operating...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

CVE-2014-5171

CVE-2014-5171 concerns SAP HANA Extend Application Services (XS). The issue is that transmissions for applications using SSL form-based authentication are not encrypted, enabling remote attackers to capture credentials and other sensitive data by sniffing the network. The affected component is th...

PT-2014-6310 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extend Application Services XS affected versions not specified Description: The issue concerns the lack of encryption for transmissions in applications that use form-based authentication with SSL, allowing remote attackers to interce...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

http-auth-finder NSE Script

Spiders a web site to find web pages requiring form-based or HTTP-based authentication. The results are returned in a table with each url and the detected method. See also: http-auth.nse http-brute.nse Script Arguments http-auth-finder.url the url to start spidering. This is a URL relative to the...

Nmap NSE net: http-form-brute

Performs brute force password auditing against http form-based authentication. SYNTAX: brute.unique: make sure that each password is only guessed once default: true http-form-brute.hostname: sets the host header in case of virtual hosting brute.retries: the number of times to retry if recoverable...