333 matches found
Troubleshooting StoreFront propagation issues
StoreFront propagation fails to complete. The issue can manifest itself with any of the following errors: StoreFront Error: "Propagation Failed on One or More Servers" StoreFront Propagation Fails with Event ID: 31 "Could not find a part of the path" StoreFront Error: "Event ID 19 Failed to Get t...
Keybase: Content spoofing due to the improper behavior of the not-found meesage
Hay , At dist.keybase.io , It's possible to inject text in the not-found message in order to trick the user to make him visit website or do something an attacker might be interested in . PoC : https://goo.gl/3WO6iH I've shortened this one because it's really long , it's needed to be on google...
HackerOne: Know whether private program for company exist or not
HI, There are some company which are hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on HackerOne or not if you can guess the username they use. Generally most company chooses the same name as their company...
Error: "HTTP 404 Not Found" When Accessing StoreFront Through NetScaler Gateway
After you enter your credentials on the NetScaler Gateway login page the following error is displayed: HTTP 404 Page Not Found...
JON: Cross Site scripting possible on the JBoss ON 404 error page
It was discovered that a cross-site scripting XSS vulnerability on a JBoss Operations Network 404 error page allowed for session fixation attacks. An attacker could use this flaw to impersonate a legitimate user, resulting in compromised integrity of secure data...
TYPO3 '404 Page not found handling' extension cross-site scripting vulnerability
TYPO3 is a free and open source content management system. 404 Page not found handling is a 404 Page not found handling extension plugin. A cross-site scripting vulnerability exists in the TYPO3 '404 Page not found handling' extension that allows remote attackers to exploit the vulnerability to...
CVE-2015-3391
The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page...
All In One WP Security & Firewall vulnerable to cross-site request forgery
Overview All In One WP Security & Firewall is WordPress plugin that provides security functionality. All In One WP Security & Firewall contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, access logs 404 events maintained by the...
Backup Job or Backup Proxy rescan fails with “Failed to create processing task for VM Error: Disk 'GUID' not found”
After installing patch 1 for Veeam Backup & Replication 8, jobs may start to fail with the following error message:Error Failed to create processing task for VM Error: Disk ''...
Code injection
The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found 404 page...
CVE-2014-8380
Cross-site scripting XSS vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer Header in a "404 Not Found" response. NOTE: this vulnerability might exist because of a CVE-2010-2429 regression...
Cross site scripting
Cross-site scripting XSS vulnerability in Splunk 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer Header in a "404 Not Found" response. NOTE: this vulnerability might exist because of a CVE-2010-2429 regression...
CVE-2014-8380
The CVE-2014-8380 is an XSS vulnerability in Splunk 6.1.1 where the Referer header in a 404 response is not properly sanitized, enabling remote attackers to inject arbitrary script/HTML in the victim’s browser. Multiple connected sources (OpenVAS, Tenable, CVE listings) corroborate this as a Refe...
Uzbey: SQL Injection
https://staging.uzbey.com/rotate-image?fid=2841+and+substringversion,1,1=4 FALSE https://staging.uzbey.com/rotate-image?fid=2841+and+substringversion,1,1=5 TRUE https://staging.uzbey.com/rotate-image?fid=2841+and+1=1+order+by+1-- TRUE...
[DLA-0021-1] fail2ban security update
Package : fail2ban Version : 0.8.4-3+squeeze3 CVE ID : CVE-2013-7176 CVE-2013-7177 Use anchored failregex for filters to avoid possible DoS. Manually picked up from the current status of 0.8 branch as of 0.8.13-29-g09b2016: - CVE-2013-7176: postfix.conf - anchored on the front, expects...
Information disclosure in the REST API
Jira reports the 404 not-found earlier than the 401 not-authorized. This discloses the non-existence of a specific issue numbers to unauthorized users. While this isn't a huge leak, this could come in useful with social engineering. Proof of concept: Both of the calls below are unauthenticated, a...
Microsoft IIS 5.0 CodeBrws.ASP Source Code Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4525/info Microsoft IIS 5.0 ships with a sample script that may be used to view the source code of other scripts in the sample scripts /IISSAMPLES directory. However, this script CodeBrws.asp does not adequately filter...
MP3Info 0.8.5a - Buffer Overflow
No description provided by source. Waste of CPU clock N2 Exploit for: mp3info! Latest version Author: jsacco - [email protected] Vendor: http://ibiblio.org/mp3info/ No-one-cares-about programs! junk = \x90\x90\x90\x908 shellcode =...
Cubic CMS SQL Injection / LFI / Path Disclosure Vulnerabilties
Cubic CMS suffers from local file inclusion, path disclosure, and remote SQL injection vulnerabilities. Cubic CMS SQL Injection / LFI / Path Disclosure I. BACKGROUND ------------------------- "CUBIC CMS" is a non-free content management system for websites and portals of any size, powerful,...