CVE-2018-8814

Cross-site request forgery CSRF vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugin/pluginname/settings by crafting a malicious request...

Authorization

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

Cisco IOS XE Software REST API Authorization Bypass Vulnerability

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

Cisco Unified Communications Manager Information Disclosure Vulnerability (CNVD-2018-05339)

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. An information disclosure...

WordPress Suspicious Command Injection

A remote attacker can send a malicious request to a WordPress web server containing arbitrary commands. Successful exploitation could result in the execution of arbitrary code in the web server...

CVE-2017-13696

A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component. Successful...

EFS Software Easy File Sharing Web Server vfolder.ghp Stack Buffer Overflow

A buffer overflow vulnerability exists in HTTP GET requests to EFS Software Easy File Sharing Web Server. The vulnerability is due to a failure on properly perform boundary checking on user input. A remote, unauthenticated attacker could exploit this vulnerability by sending a malicious HTTP...

Cross-site Request Forgery (CSRF)

TeamPass is vulnerable to cross-site request forgery CSRF attacks. The library does not generate session tokens for users, meaning a user can pass a malicious request as another user...

CVE-2016-5789

A Cross-site Request Forgery issue was discovered in JanTek JTC-200, all versions. An attacker could perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request...

Apache Tomcat VirtualDirContext Information Disclosure (CVE-2017-12616)

An information disclosure vulnerability exists in Apache Tomcat. By crafting a malicious request an attacker may view the source code of jsp files for resources...

CVE-2017-9793

A flaw was found in the Struts REST plugin when using an outdated XStream library. An attacker could perform a denial of service attack using a malicious request with specially crafted XML payload...

docker-distribution: Does not properly restrict the amount of content accepted from a user

It was found that docker-distribution did not properly restrict memory allocation size for a registry instance through the manifest endpoint. An attacker could send a specially crafted request that would exhaust the memory of the docker-distribution service...

Null pointer dereference

A maliciously constructed HTTP/2 request could cause modhttp2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process...

CVE-2017-7529 Nginx integer overflow vulnerability analysis-vulnerability warning-the black bar safety net

1, the vulnerability described in In the Nginx range filter in the presence of an integer overflow vulnerability that can be through with the special structure of the range of the HTTP header of the malicious request to trigger this integer overflow vulnerability, and lead to information leakage...

HPE Network Automation FileServlet Information Disclosure (CVE-2017-5811)

An information disclosure vulnerability exists in HPE Network Automation. The vulnerability is due to a lack of sanitization on a user supplied path on requests handled by FileServlet. A remote attacker could exploit this vulnerability by sending a maliciously crafted request to the target server...

Brocade Network Advisor FileReceiveServlet filename Directory Traversal (CVE-2016-8204)

A directory traversal vulnerability exists in Brocade Network Advisor. The vulnerability is due to lack of authentication and insufficient input validation in the FileReceiveServlet servlet when processing HTTP multipart form requests. A remote, unauthenticated attacker can exploit this...

Cross site request forgery (csrf)

The Siemens web application RUGGEDCOM NMS V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request Forgery CSRF attack, potentially allowing an attacker to execute administrative operations, provided the targeted user has an active session and is induced to...

Automattic: Captcha bypass for the most important function - At en.instagram-brand.com

Product / URL https://en.instagram-brand.com/wp-json/brc/v1/approval-requests Description and Impact The Instagram Brand Site has a functionality for business users to request for using Instagram Assets. The URL for creating a new request is: https://en.instagram-brand.com/requests/new There is a...

WordPress REST API Content Injection

A content injection vulnerability exists in WordPress REST API. A remote attacker may exploit this vulnerability by sending a malicious request to the server. Successful exploitation would allow an attacker to inject and change content...

Disk Savvy Enterprise - GET Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'DiskSavvy Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...