50 matches found
Command injection
The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors related to an "HTTP command injection issue."...
Cisco IP Phone 8861 Multiple WPA2 Vulnerabilities
Cisco IP Phone 8861 is prone to key reinstallation attacks against WPA protocol. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Wi-Fi Protected Access (WPA) handshake traffic can be manipulated to induce nonce and session key reuse
Overview Wi-Fi Protected Access WPA, more commonly WPA2 handshake traffic can be manipulated to induce nonce and session key reuse, resulting in key reinstallation by a wireless access point AP or client. An attacker within range of an affected AP and client may leverage these vulnerabilities to...
CrushFTP HTTP Injection Vulnerability
CrushFTP is a cross-platform Java FTP server from the U.S. CrushFTP company . A security vulnerability exists in CrushFTP versions prior to 7.8.0 and 8.x versions prior to 8.2.0. No detailed vulnerability details are provided at this time...
Wikileaks Unveils CIA's Man-in-the-Middle Attack Tool
Wikileaks has published a new batch of the Vault 7 leak, detailing a man-in-the-middle MitM attack tool allegedly created by the United States Central Intelligence Agency CIA to target local networks. Since March, WikiLeaks has published thousands of documents and other secret tools that the...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update
An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
Chinese ISPs Caught Injecting Ads and Malware into Web Pages
China has gained a considerable global attention when it comes to their Internet policies in the past years; whether it's introducing its own search engine dubbed "Baidu," Great Firewall of China, its homebrew China Operating System COP and many more. Along with the developments, China has long...
Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection Vulnerability
Sierra Wireless produces a mobile wi-fi hotspot device that is popular amongst telecommunication companies for re-branding to suit local markets. The AirCard 760S/762S/763S Web-based Administrative Console suffers from a HTTP header injection that allows an attacker to inject a file into the HTTP...
PHPList Mailing List Manager 2.x /admin/eventlog.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...
PHPList Mailing List Manager 2.x /admin/users.php find Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...
PHPList Mailing List Manager 2.x /admin/admin.php id Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...
PHPList Mailing List Manager 2.x /admin/editattributes.php id Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/15350/info PHPList is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly santize user-supplied input. The application is prone to multiple cross-site...
i2Ninja Financial Malware Communicates on I2P Darknet
The Mevade botnet made news when it was found to be using the Tor anonymity network to communicate with its command and control infrastructure. Running C&C on Tor, however, turned out to be a fatal mistake when Tor usage spiked alerting administrators to the unusual activity. A group of Russian...
cultbooking 2.0.4 - Multiple Vulnerabilities
cultbooking 2.0.4 - Multiple Vulnerabilities CultBooking 2.0.4 lang Local File Inclusion Vulnerability Vendor: Cultuzz Digital Media GmbH Product web page: http://www.cultuzz.com Affected version: 2.0.4 Summary: Open source hotel booking system Internet Booking Engine IBE. Via a central api calle...
SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6655)
The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...
Oracle WebLogic Server Plug-in HTTP Injection
The remote web server is using the WebLogic plug-in for Apache, IIS, or Sun web servers, a module included with Oracle formerly BEA WebLogic Server and used to proxy requests from an HTTP server to WebLogic. The version of this plug-in on the remote host is affected by an HTTP injection...
CVE-2010-2375: WebLogic Plugin HTTP Injection via Encoded URLs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebLogic Plugin HTTP Injection via Encoded URLs Release Date: 2010-07-13 Application: WebLogic Plugin...
WebLogic Plugin HTTP Injection Via Encoded URLs
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: WebLogic Plugin HTTP Injection via Encoded URLs Release Date: 2010-07-13 Application: WebLogic Plugin...
CVE-2010-2504
Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection, aka SPL-31066...
JSBoard 2.0.10 - login.php?table Local File Inclusion
JSBoard 2.0.10 - login.php?table Local File Inclusion !/usr/bin/perl jsboard 2.0.10login.php tableLocal File Inclusion Exploit D.Script: http://kldp.net/frs/download.php/1729/jsboard-2.0.10.tar.gz if$table && fileexists"data/$table/config.php" include "data/$table/config.php"; Discovered & Coded ...