CVE-2014-5417

CVE-2014-5417 affects Meinberg NTP Server firmware on LANTIME M-Series (≤ 6.15.019). The web interface contains a reflected/XSS flaw in input handling that could allow remote attackers to inject arbitrary script/HTML via unspecified vectors. Mitigation: Meinberg released firmware 6.15.020 to reso...

CVE-2014-5417 Meinberg Radio Clocks LANTIME M-Series

Cross-site scripting XSS vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-6461

Name of the Vulnerable Software and Affected Versions Meinberg NTP Server firmware on LANTIME M-Series devices versions 6.15.019 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For...

CVE-2014-5417: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Meinberg NTP Server firmware on LANTIME M-Series devices 6.15.019 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

m-thong.com XSS vulnerability

Open Bug Bounty ID: OBB-51298 Description| Value ---|--- Affected Website:| m-thong.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2014-6409

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

Design/Logic Flaw

M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...

CVE-2014-6409

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

CVE-2014-6607

M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...

CVE-2014-6409

CVE-2014-6409 is a CSRF vulnerability in M/Monit 3.3.2 and earlier. The issue allows an attacker to hijack administrator sessions and trigger password changes by submitting requests to /admin/users/update with fullname and password parameters. The root cause is lack of sufficient CSRF protection ...

CVE-2014-6607

CVE-2014-6607 affects M/Monit 3.3.2 and earlier. The issue is a CSRF vulnerability where an attacker can change any user’s password via the fullname and password parameters to /admin/users/update because the application does not verify the original password before changing it. Impact is remote co...

CVE-2014-6607: Undefined Security Weakness

M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...

CVE-2014-6409: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

PT-2014-7298

Name of the Vulnerable Software and Affected Versions M/Monit versions 3.3.2 and earlier Description The issue allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters. Recommendations For M/Monit versions 3.3.2 and earlier, at the...

PT-2014-7212

Name of the Vulnerable Software and Affected Versions M/Monit versions 3.3.2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that change user passwords. This is achieved via the fullname and password parameters...

M/Monit 3.3.2 - CSRF Vulnerability

No description provided by source. Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: = 3.2.2 Fixed version: N/A 1. About the application ------------------------ Eas...

m-g.ru Open Redirect vulnerability

Open Bug Bounty ID: OBB-50116 Description| Value ---|--- Affected Website:| m-g.ru Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerable URL:...

M/Monit 3.3.2 - Cross-Site Request Forgery

Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: CSRF PoC for M/monit input type="submit" name="subm...

M/Monit 3.2.2 Cross Site Request Forgery Vulnerability

M/Monit versions 3.2.2 and below suffer from multiple cross site request forgery vulnerabilities. Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the...