Cross site request forgery (csrf)

Cloud Foundry PHP Buildpack aka php-buildpack before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers t...

CVE-2016-6639

Cloud Foundry PHP Buildpack aka php-buildpack before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers t...

coap-resources NSE Script

Dumps list of available resources from CoAP endpoints. This script establishes a connection to a CoAP endpoint and performs a GET request on a resource. The default resource for our request is code/.well-known/core/core, which should contain a list of resources provided by the endpoint. For...

CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

WebNMS Framework 5.2SP1 Login Bypass

Summary WebNMS is an industry-leading used to build network management applications architecture. By submitting a custom headers parameter can directly obtain the session Cookie, skip login authentication. Vulnerability details Submit the following Get request HTTP header, add a UserName specify ...

Khan Academy: Sensitive information/action is stored/done is done using a GET request

Description: The action to remove an email from account is done using a GET request and it has security token. The URL is : https://www.khanacademy.org/settings/unlinkaccount?email=134hackerone%40gmail.com&fkey= It is never a good practice to have sensitive information in URL. Following are the...

Nextcloud: \OCA\DAV\CardDAV\ImageExportPlugin allows serving arbitrary data with user-defined or empty mimetype

The SabreDAV plugin \OCA\DAV\CardDAV\ImageExportPlugin is used for displaying pictures of a VCF. It registers on a GET request on a CardDAV element and acts when the query parameter photo is sent. The logic can be seen below: / Intercepts GET requests on addressbook urls ending with ?photo. @para...

NUUO NVRmini 2 <= 3.0.8 LFI Vulnerability - Active Check

NUUO NVRmini 2 devices are prone to a local file disclosure LFI vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

VideoIQ Camera Remote Detection

Detects the installed version of VideoIQ Camera. This script sends an HTTP GET request and tries to ensure the presence of VideoIQ Camera. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Samsung Security Manager 1.5 ActiveMQ Broker Service remote code execution vulnerability

No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Samsung Security Manager 1.5 ActiveMQ Broker Service PUT Method Remote Code Execution",...

Fotoware Fotoweb Cross-site Scripting Vulnerability

Fotoware Fotoweb is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

The web framework in Cisco Unified Computing System UCS Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827...

CVE-2016-1374

The web framework in Cisco Unified Computing System UCS Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827...

Cisco Data Center Operations Management Solution in the presence of a serious vulnerability-a vulnerability warning-the black bar safety net

! Cisco is a leading global network solutions provider, the company is committed to numerous companies to build network unimpeded,“Bridge”, and with his own keen insight, rich industry experience, advanced technology, help enterprises to put the network into a strategic asset, to fully tap the...

Gratipay: Username .. (double dot) should be restricted or handled carefully

If I change my username to "test" then as in normal case it will send a GET request to /test/settings but if I change my username to ".." double dot within inverted commas then it will send GET request to /settings because /../settings will change to /settings and hence final GET request will be ...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report|http://jira.atlassian.com/browse/JRASERVER-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

XSS in /includes/decorators/global-translations.jsp

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61888. panel Somewhat hard to exploit but still doable when it comes to cache poisoning. Steps to reproduce: Tamper with a GET request to...

OLX: cross-site scripting in get request

https://olx.pt/ads/?q=?alert1 where "q" is the vulnerable parameter which triggers cross-site scripting...

The vulnerability of Juniper SRX 240 router microprogramming software allows a attacker to bypass the CSRF protection of the J-Web interface.

The Juniper SRX 240 router software contains a vulnerability in the Sajax AJAX library, which stems from the lack of checking the “csrftoken” parameter for GET requests...