4604 matches found
Allaire JRun 3 Directory Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1830/info Allaire JRun is a web application development suite with JSP and Java Servlets. Each web application directory contains a WEB-INF directory, this directory contains information on web application classes,...
Omnicron OmniHTTPD 2.0.4-8 File Source Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2788/info Submitting a specially crafted GET request for a known file .php, .pl, or .shtml, could cause OmniHTTPD to disclose the source code of the requested resource. The GET requested would have to be appended with the...
HP JetDirect Printer SNMP JetAdmin Device Password Disclosure Vulnerability
No description provided by source. HP JetDirect J2552A/J2552B/J2591A/J3110A/J3111A/J3113A/J3263A/300.0 X Printer SNMP JetAdmin Device Password Disclosure Vulnerability source: http://www.securityfocus.com/bid/7001/info A problem with JetDirect printers could make it possible for a remote user to...
TinyServer 1.1 - Denial of Service
No description provided by source. source: http://www.securityfocus.com/bid/9485/info TinyServer is prone to multiple vulnerabilities. A directory traversal issue is present in TinyServer that could allow a remote user to view or download any file to which the server has access. A denial of servi...
AnalogX SimpleServer:WWW 1.0.1 GET Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/906/info The SimpleServer:WWW personal webserver package from AnalogX can be compromised due to an overflowable buffer. If a GET request longer than 1000 bytes is received, the software will crash and data from the reques...
Eugene Ajenti 'respond_error' Multiple Cross-Site Scripting Vulnerabilities
Eugene Ajenti is prone to multiple cross-site scripting vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Gitlist RCE Vulnerability
Gitlist is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Lack of CSRF protection on Voting
On Confluence Questions, answers and questions can be upvoted by the victim automatically on a question page visit, due to the lack of CSRF protection. When up voting a question manually, whilst on the question page, a single post request is issued: e.g. POST...
Assesi 'bg' Parameter SQL Injection vulnerability
Assesi is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ClipBucket < 2.7 XSS Vulnerability - Active Check
ClipBucket is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2014-4158
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET request...
Stack overflow
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET request...
CVE-2014-4158
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET request...
CVE-2014-4158
CVE-2014-4158 pertains to Senkas Kolibri WebServer 2.0 on Windows (XP/2003/7). The vulnerability is a stack-based buffer overflow caused by improper validation when handling HTTP requests with overly long URIs, enabling a remote attacker to potentially execute arbitrary code. Public writeups desc...
PT-2014-5709
Name of the Vulnerable Software and Affected Versions Kolibri version 2.0 Description The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by sending a long URI in a GET request. Recommendations For Kolibri version 2.0, update to a...
CVE-2014-4158: Improper Restriction of Operations within the Bounds of a Memory Buffer
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET request...
ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection
This module exploits an unauthenticated blind SQL injection in LinkViewFetchServlet, which is exposed in ManageEngine Desktop Central v7 build 70200 to v9 build 90033 and Password Manager Pro v6 build 6500 to v7 build 7002 including the MSP versions. The SQL injection can be used to achieve remot...
WePay: CSRF & Nonce Token Weak Implementation
Hello, this report is a copy of my previous reports sent to your email [email protected] some days ago. Please note that everything written below are copied and pasted from the report. Ticket 437212 : As part of your responsible disclosure program, I am reporting this leakage weak implementation...
Direct Object Reference - User Information Disclosure
A direct object reference vulnerability exists on the answers.atlassian.com platform which allows for malicious users to obtain the email address of any given ID. Additionally since the ID's are incremental, it would be possible for an attacker to gain the email addresses of every single Atlassia...
DIR-605L Disclosure / Bypass
DIR-605L Hardware version Ax, firmware 1.14 has two severe security bug: 1. The login password is printed out in clear text in the "Current Network Setting" page just after login "Device Info" section. 2. The router can be controlled using a crafted URL GET request, even without login e.g. use an...