omniauth leaks authenticity token in callback params

In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...

Fedora 24 : ghostscript (2016-3dad5dfd03)

This update fixes a rare ocasion where ghostscript would fail when displaying .ps files. More info can be found here. ---- This is a security update for these CVEs : - CVE-2016-8602 - check for sufficient params in .sethalftone5 - CVE-2016-7977 - .libfile does not honor -dSAFER This CVE is now...

PT-2016-3472 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.6-rc6-next-20120917 Description: The issue is related to an integer overflow in the snd compr allocate buffer function in the ALSA subsystem. This can be exploited by local users via a crafted SNDRV COMPRESS S...

Linux kernel ALSA subsystem denial of service vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability exists in the 'sndcompresscheckinput' function in the sound/core/compressoffload.c file in the ALSA subsystem of the Linux kernel prior to version 3.1...

DEBIAN-CVE-2014-9904

The sndcompresscheckinput function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service insufficient memory allocation or possibly have unspecified other impact...

Rack 'normalize_params()' function denial of service vulnerability

Rack is a Ruby Web server interface that unifies APIs for Web servers, Web frameworks, and middleware, and supports calling them using a single method. A security vulnerability in the Rack 'normalizeparams' function allows remote attackers to conduct denial-of-service attacks that can be exploite...

The vulnerability of the Red Hat Enterprise Linux operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the sblim-cmpi-params-test-1.2.6 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of this vulnerability can be carried out locally...

mcms最新版SQL注入一枚

简要描述： mcms最新版SQL注入一枚 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：/app/public/user.php?m=recharge&ajax=1 POST中有个参数params存在注入。 function mrecharge global $dbm; checklevel'C0503',AJAX; $fields = array;...

CVE-2015-2839

The Nitro API in Citrix NetScaler before 10.5 build 52.3nc uses an incorrect Content-Type when returning an error message, which allows remote attackers to conduct cross-site scripting XSS attacks via the filename JSON member in params/xenhotfix/0 to nitro/v1/config/xenhotfix...

FancyFon Software FAMOC SQL Injection Vulnerability

FancyFon Software FAMOC is a mobile device lifecycle management solution from FancyFon Software Ireland. The solution enables centralized remote management of smartphones using various operating systems over the Internet. A SQL injection vulnerability exists in FancyFon Software FAMOC versions...

MemHT Portal 4.0.1 - SQL Injection Code Execution Exploit

No description provided by source. !/usr/bin/perl =about MemHT 4.0.1 Perl exploit AUTHOR discovered & written by Ams ax330d doggy gmail dot com VULN. DESCRIPTION: Due to weak params filtering we are able to make SQL-Injection. So, 1. Look at 'inc/ajax/ajaxrating.php', line 29. It is not enough to...

Concrete CMS: FULL PATH DISCLOSUR

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

CVE-2014-0359

Xangati XSR before 11 and XNR before 7 allows remote attackers to execute arbitrary commands via shell metacharacters in a guiinputtest.pl params parameter to servlet/Installer...

CVE-2013-7298

queryparams.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service infinite recursion and crash via an HTTP query that contains %% double percent characters...

Practico 13.9 - Multiple Vulnerabilities

Practico 13.9 Multiple Vulnerabilities Vendor: Practico Product web page: http://www.codigoabierto.org Affected version: 13.9 Summary: Practico is a free CMS software project released under license GNU GPL v2.0 for creating web applications in a completely visual and fast fashion. Without...

XML-RPC PingBack API Remote DoS Exploit (through xmlrpc.php)

Exploit for php platform in category dos / poc Exploit Title: XML-RPC PingBack API Remote Denial of Service exploit through xmlrpc.php Date: 04/01/2013 Category: Remote Exploit Author: D35m0nd142 Tested on: Debian Linux !/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common; use...

BroadWorks - Call Detail Record Security Bypass

BroadWorks - Call Detail Record Security Bypass source: https://www.securityfocus.com/bid/44597/info BroadWorks is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and to obtain sensitive information. Successful exploits will...

CVE-2010-1909

Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these details are obtained...

Buffer overflow

Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these details are obtained...

CVE-2010-1909

Buffer overflow in the RunCmd method in the SdcUser.TgConCtl ActiveX control in tgctlcm.dll in Consona Live Assistance, Dynamic Agent, and Subscriber Assistance allows remote attackers to execute arbitrary code via vectors involving "CreateProcess params." NOTE: some of these details are obtained...