IBM Netezza Performance Portal用户验证凭据管理绕过漏洞

CVE ID:CVE-2013-6731 IBM Netezza数据仓库应用设备将存储、处理、数据库和分析融入到一个高性能数据仓库设备中,使大数据高级分析更简单、更迅捷和更易用。 IBM Netezza Performance Portal不正确限制对验证凭据管理的访问，允许攻击者利用漏洞通过特制的HTTP POST请求来更改其他用户的密码。 0 IBM Netezza Performance Portal 2.0 IBM Netezza Performance Portal 2.0.0.1 IBM Netezza Performance Portal 2.0.0.2 厂商补丁： IBM...

CVE-2013-6492

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

Authentication flaw

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

CVE-2013-6492

The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request...

PT-2025-31542 · Linksys · Linksys Wrt120N

Name of the Vulnerable Software and Affected Versions: Linksys WRT120N wireless routers affected versions not specified Description: A stack-based buffer overflow exists in the tmUnblock.cgi endpoint of Linksys WRT120N wireless routers. The issue occurs when processing the TM Block URL parameter...

Geeklog Calendar Plugin Cross Site Scripting Vulnerability

Geeklog is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting (XSS) in Ilch CMS

High-Tech Bridge Security Research Lab discovered vulnerability in Ilch CMS, which can be exploited to perform Cross-Site Scripting XSS attacks against users and administrators of vulnerable application. 1 Cross-Site Scripting XSS in Ilch CMS: CVE-2014-1944 The vulnerability exists due to...

Synology DiskStation Manager arbitrary file modification

Overview Synology DiskStation Manager versions 4.3-3776-3 and below contain a vulnerability that allows a remote unauthenticated user to append arbitrary data to an arbitrary file under root privileges. Description CWE-284: Improper Access Control - CVE-2013-6955Synology DiskStation Manager...

Amazon Linux AMI : php (ALAS-2012-37)

It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by...

Atlassian Crowd Xml eXternal Entity (XXE) Injection Vulnerability

This host is running Atlassian Crowd and is prone to xml external entity injection vulnerability. OpenVAS Vulnerability Test $Id: gbatlassiancrowdxxeinjvuln.nasl 5842 2017-04-03 13:15:19Z cfi $ Atlassian Crowd Xml eXternal Entity XXE Injection Vulnerability Authors: Thanga Prakash S Copyright:...

Gallery Server Pro File Upload Filter Bypass Vulnerability

Gallery Server Pro suffers from a file upload filter bypass vulnerability. , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / / .-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Gallery Server Pro File Upload Filter Bypass Vendor Link:...

Vanilla Forums 2-0-18-4 - SQL-Injection Vulnerability

SQL-Injection is possible, because$POST arrays are not proper sanitized. You do not need to be authenticated. To insert an arbitrary user, a sample HTTP-Post Request looks as follows: POST /PATH/vanilla/entry/signin HTTP/1.1 Host: HOST User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:19.0...

Design/Logic Flaw

main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which...

CVE-2013-2686

main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which...

RHEL 4 / 5 : jbossas (RHSA-2011:1309)

Updated jbossas packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.2.0.CP09 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVS...

RHEL 4 / 5 / 6 : jbossws-common (RHSA-2011:1301)

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.1 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

RHEL 4 / 5 : jbossws-common (RHSA-2011:1306)

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

Multiple SQL Injection vulnerabilities in ClipBucket

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in ClipBucket, which can be exploited to perform SQL Injection attacks. 1 Multiple SQL Injections in ClipBucket: CVE-2012-5849 1.1 The vulnerability exists due to improper sanitation of input in multiple parameters within...

Cross site request forgery (csrf)

Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid MRG 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor...

Cisco Scientific Atlanta D20 and D30 Based Cable Modem Cross-Site Scripting Vulnerability

Cisco Scientific Atlanta cable modems D20 and D30 based products contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient sanitization of user-supplied input to the web wizard setup web page. An...