IBM OmniFind Crawler Denial of Service Vulnerability

No description provided by source. Crawler endless loop CVE-2010-3899 The crawler has no recursion depth limit. A site with dynamic parameter manipulation can cause an endless loop. This loop will block the crawler thread and use permanent server resources. Too many blocks can lead to a denial of...

Axous 1.1.1 - Multiple Vulnerabilities (CSRF - Persistent XSS)

No description provided by source. +-----------------------------------------------------------------------------------------------------------+ Exploit Title : Axous 1.1.1 Multiple Vulnerabilities CSRF - Persistent XSS Date : 30-04-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software...

DCP-Portal 3.7/4.x/5.x/6.x mycontents.php Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17050/info DCP Portal is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

Burning Board 1.1.1 URL Parameter Manipulation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4512/info Burning Board is web forum software. It is written in PHP, back-ended by MySQL, and will run on most Unix and Linux variants as well as Microsoft Windows. An attacker may allegedly create a malicious link which ...

C-News 1.0.1 - 'install.php' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28989/info C-News is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Comersus Open Technologies Comersus 5.0 comersus_message.asp XSS

No description provided by source. source: http://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order. Comersu...

dompdf 0.6.0 beta1 - Remote File Inclusion Vulnerability

No description provided by source. ================================== apps dompdf RFI Vulnerability ================================== ==================================================== x ExpL0it TitLe : apps dompdf RFI Vulnerability x DatE : 01 September 2010 x AutH0r : AndreCorleone x Softwar...

Comersus Open Technologies Comersus 5.0 comersus_gatewayPayPal.asp Price Manipulation

No description provided by source. source: http://www.securityfocus.com/bid/10674/info Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order. Comersu...

CVE-2014-4335

Multiple cross-site scripting XSS vulnerabilities in BarracudaDrive 6.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 host or 2 password parameter to rtl/protected/admin/ddns/...

大汉JCMS 注入漏洞3

简要描述： 大汉JCMS 注入漏洞3 详细说明： shortmessage/quesendmsg.jsp String strTitle = ""; /检索关键字/ String groupname = ""; String id = Convert.getParameterrequest, "loginid", "a";//获取参数 String boxtype = Convert.getParameterrequest, "boxtype", "a"; strTitle += groupname; // 获取表单提交变量条件参数 String strQueKeyWords =...

Updated struts packages fix CVE-2014-0114

Updated struts packages fix security vulnerability: It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running...

CentOS Update for struts CESA-2014:0474 centos5

Check for the Version of struts OpenVAS Vulnerability Test CentOS Update for struts CESA-2014:0474 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

CVE-2013-7368

Multiple cross-site scripting XSS vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gnewtemplate parameter to 1 users/profile.php, 2 articles/index.php, or 3 admin/polls.php; 4 categoryid parameter to news/submit.php; newsid parameter to 5...

MeiuPic 'ctl'参数本地文件包含漏洞

Bugtraq ID:66317 MeiuPic是一款简易相册应用。 MeiuPic不正确过滤用户提交给'ctl'参数的数据，允许远程攻击者利用漏洞提交特制的请求，以WEB权限查看系统文件内容。 0 MeiuPic 2.1.2 目前没有详细解决方案提供： http://meiupic.meiu.cn http://www.example.com/MeiuPic/?ctl=../../../../../../../../../../etc/passwd...

CVE-2013-2269

The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in...

Design/Logic Flaw

The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in...

CVE-2013-2269

The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7, allows remote attackers to bypass intended access restrictions and approve a request by sending a guest request, then using "parameter manipulation" in...

CVE-2013-2269

The CVE-2013-2269 entry describes a logic flaw in Aruba Networks ClearPass (5.x, 6.0.1, 6.0.2) and Amigopod/ClearPass Guest (3.0–3.9.7) where an attacker can bypass access controls by initiating a guest request, then using parameter manipulation and information from a default holding page to loca...

NETELLER Direct Payment API is not vulnerable to reported parameter manipulation

Overview NETELLER Direct Payment API version 4.1.6 and possibly earlier versions were reported to be vulnerable to parameter manipulation via a modified HTTP POST request. After further analysis and discussion with NETELLER, this report was found to be incorrect. The NETELLER Direct Payment API i...

phpMyAdmin 4.x < 4.0.4.1 import.php GLOBALS Variable Injection Configuration Parameter Manipulation (PMASA-2013-7)

According to its self-identified version number, the phpMyAdmin 4.x install hosted on the remote web server is earlier than 4.0.4.1 and, therefore, contains a flaw where the 'import.php' script does not properly sanitize input. This could allow attackers to inject arbitrary GLOBALS variables and...