10025 matches found
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...
CVE-2015-7366
Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...
CVE-2015-7366
Multiple cross-site request forgery CSRF vulnerabilities in Revive Adserver before 3.2.2 allow remote attackers to hijack the authentication of users for requests that 1 perform certain plugin actions and possibly cause a denial of service disabled core plugins via unknown vectors or 2 change the...
F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - File Path Traversal Vulnerability
Exploit for hardware platform in category web applications Exploit Title: F5 BigIP File Path Traversal Vulnerability Discovered by: Karn Ganeshen Reported on: April 27, 2015 New version released on: September 01, 2015 Vendor Homepage: www.f5.com Version Reported: F5 BIG-IP 10.2.4 Build 595.0 Hotf...
Liferay 6.1.0 CE - Privilege Escalation
Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation Date: 18/05/2015 Exploit Author: Massimo De Luca - mentat.is Vendor Homepage: https://www.liferay.com Software Link: http://www.liferay.com/it/community/releases/-/assetpublisher/nSr2/content/id/18060360 Version: 6.1.0 CE Tested on: -...
kppw最新版2处sql注入。
简要描述： 二次注入。 详细说明： 1 /www/control/user/accountbasic.php ..... $arrMemberExts = kekezu::gettabledata "", "witkeymemberext", " type='sect' and uid= ".$gUid, "", "", "", "k" ; ........ if $sect foreach $sect as $k = $v if $arrMemberExts $k dbfactory::execute sprintf " update %switkeymemberext set...
Shopify: change Login Services settings without owner access
Hi in settings - account owner can set login service for staff members! this is only available for owners, and full access admins can't see or change this values! admin with setting access can send a "POST" request to shop.json and change this settings! steps: - get access token for one full acce...
Sql injection
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.11.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824...
CVE-2015-6299: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the web interface in Cisco Unity Connection 9.11.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824...
Cisco Unity Connection Web Interface SQL Injection Vulnerability
A vulnerability in the web interface of Cisco Unity Connection UC could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker...
Bedita 3.5.1 - Cross-Site Scripting
Bedita 3.5.1 - Cross-Site Scripting Title: Bedita 3.5.1 XSS vulnerabilites Application: Bedita Version: 3.5.1 Software Link: http://www.bedita.com/ Date: 2015-03-09 Author: Sébastien Morin Contact: https://twitter.com/SebMorin1 Category: Web Applications =================== Introduction:...
迪普UMC统一管理系统SQL注入
DPtech UMC统一管理中心案例：http://222.171.148.161/UMC/Login.action http://222.75.152.197:8080/UMC/Login.action http://222.47.70.3:8080/UMC/Login.action http://218.28.177.149/UMC/Login.action http://211.138.102.195:8080/UMC/Login.action针对部分型号，并不通杀。POST /UMC/Login.action HTTP/1.1 Host: 222.171.148.161...
up.time 7.5.0 Superadmin Privilege Escalation
up.time 7.5.0 Superadmin Privilege Escalation Exploit Vendor: Idera Inc. Product web page: http://www.uptimesoftware.com Affected version: 7.5.0 build 16 and 7.4.0 build 13 Summary: The next-generation of IT monitoring software. Desc: up.time suffers from a privilege escalation issue. Normal user...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Cisco Finesse 10.51 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975...
CVE-2015-4302
The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390...
PT-2015-6511
Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT Management Center version 5.3.1.4 Description The issue concerns the web interface, where remote attackers can delete arbitrary system policies by modifying parameters in a POST request. Recommendations For Cisco FireSIGHT...
PT-2015-6517
Name of the Vulnerable Software and Affected Versions Cisco Finesse version 10.51 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a GET or POST request. Recommendations For Cisco Finesse version 10.51, update to a version that fix...
CVE-2015-4302: Improper Access Control
The web interface in Cisco FireSIGHT Management Center 5.3.1.4 allows remote attackers to delete arbitrary system policies via modified parameters in a POST request, aka Bug ID CSCuu25390...
CVE-2015-4310: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Cisco Finesse 10.51 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975...
