9635 matches found
Code injection
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81713...
CVE-2014-3303
The web framework in Cisco WebEx Meetings Server does not properly restrict the content of query strings, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug ID CSCuj81713...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
EAP6: Plain text password logging during security audit
It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...
OWASP iOSForensic - Tool to help in forensics analysis on iOS
OWASP iOSForensic is a python tool to help in forensics analysis on iOS. It get files, logs, extract sqlite3 databases and uncompress .plist files in xml. OWASP iOSForensic provides: Application's files Conversion of .plist files in XML Extract all databases Conversion of binary cookies...
CVE-2014-3297
Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug...
Wordpress Plugin Better WP Security - Stored XSS
No description provided by source. ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better...
Plesk < 9.5.4 - Zeroday Remote Exploit
No description provided by source. Plesk Apache zeroday / June 2013 discovered & exploited by kingcope this Plesk configuration setting makes it possible: scriptAlias /phppath/ /usr/bin/ Furthermore this is not cve-2012-1823 because the php interpreter is called directly. no php file is called...
Yaws <= 1.55 Terminal Escape Sequence in Logs Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37716/info Yaws is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal. Yaws 1.8...
Ultimate PHP Board <= 2.2.1 (log inj) Privilege Escalation Exploit
No description provided by source. !/usr/bin/perl -w ------------------------------------------------------------------ Ultimate PHP Board = 2.2.1 log inj Privilege Escalation Exploit ------------------------------------------------------------------ by athos - stakerathotmaildotit download on...
pragmaMX Module Landkarten 2.1 - Local File Inclusion Exploit (win)
No description provided by source. !Perl pragmaMX Landkartenmodule 2.1 Local File Inclusion Exploit Vendor: http://www.pragmamx.org/Downloads-op-getit-lid-599-noJpC-.html Vulnerable Code: requireoncemodules/$modulename/inc/conf.php; Coded by bd0rk || SOH-Crew Greetz: str0ke, Diddi, seduce, TheJT,...
eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities
No description provided by source. !--- Title: eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities Author: 10n1z3d 10n1z3datwdotcn Date: Thu 15 Jul 2010 12:08:07 PM EEST Vendor: http://www.xmbforum.com/ Download: http://www.xmbforum.com/download/XMB-1.9.11.09.zip --- -= CSRF PoC 1 - Change...
VoipNow <= 2.5 - Local File Inclusion Vulnerability
No description provided by source. / + Application : Voipnow | Version , Perior to 2.5.0 | Download : http://4psa.com/ | By Faris , AKA i-Hmx | [email protected] + sec4ever.com , 1337s.cc / VoipNow is commercial web GUI voip server manager, it's affected by local file inclusion vuln File :...
jakcms 2.0 pro rc5 - Stored XSS via useragent http header injection
No description provided by source. Exploit Title: JAKCMS 2.0 PRO RC5 stored XSS via useragent HTTP header Injection Date: 7-2-2011 Author: Saif El-Sherei Software Link: http://php.opensourcecms.com/scripts/redirect/download.php?id=480 Version: JAKCMS PRO 2.0 RC5 and probably earlier version Teste...
PHPizabi 0.848b - C1 HFP1 Remote Privilege Escalation Vulnerability
No description provided by source. -------------------------------------------------------------------------------- PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation php.ini independent by Nine:Situations:Group::bookoo...
nginx 0.7.64 Terminal Escape Sequence in Logs Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37711/info The 'nginx' program is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files. Attackers can exploit this issue to execute arbitrary commands in a...
ATutor 1.5.1 Chat Logs Remote Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14832/info ATutor is prone to a remote information disclosure vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged information. A remote...
AOLServer Terminal <= 4.5.1 Escape Sequence in Logs Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37712/info AOLServer is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles. Attackers can exploit this issue to execute arbitrary commands in a terminal...
unclassified newsboard 1.6.4 - Multiple Vulnerabilities
No description provided by source. Author girex Homepage girex.altervista.org Date 31/05/2009 CMS Unclassified NewsBoard 1.6.4 and maybe lower Dork This board is powered by the Unclassified NewsBoard software, 1.6.4 Multiple remote vulnerabilities 1 Remote SQL Injection php.ini regardless 2 Logs...
BirdBlog 1.4 /admin/logs.php page Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/21184/info BirdBlog is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code...