Design/Logic Flaw

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request...

CVE-2011-2720

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request...

Citrix XenApp / XenDesktop XML Service Heap Corruption

No description provided by source. n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2011.002 28-Jul-2011 Vendor: Citrix, http://www.citrix.com Affected Products: XenApp and XenDesktop Affected Version: See the Citrix security bulletin 2 for a list Vulnerability: Heap Corruption in...

VulnCheck KEV: CVE-2009-1151

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file...

glpi -- remote attack via crafted POST request

The GLPI project reports: The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request...

Design/Logic Flaw

Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service application crash via a crafted web site, related to GetWidget methods...

Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution

The Trend Micro Control Manager install on the remote Windows host is missing Critical Patch 1422. As such, the included CasLogDirectInsert.aspx http handler reportedly has a vulnerability by which malicious XML and schema information can be used in queries in the backend database. Using a...

Trend Micro Control Manager CasLogDirectInsertHandler.cs Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the CasLogDirectInsert.aspx...

Portech MV-372 VoIP Gateway - Multiple Vulnerabilities

Portech MV-372 VoIP Gateway - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/48560/info The Portech MV-372 VoIP Gateway is prone to multiple security vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information, cause vulnerable devices to...

Joomla com_propiedades Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Joomla comcompropiedades Multiple Vulnerabilities Date: 23.06.2011 Author: z0mbyak Vendor or Software Link: find by yourself Version: Don't know Category: remote, webapps. Google dork: inurl:"index.php?option=com propiedades"...

IBM Tivoli Endpoint Manager POST Query Buffer Overflow

This module exploits a stack based buffer overflow in the way IBM Tivoli Endpoint Manager versions 3.7.1, 4.1, 4.1.1, 4.3.1 handles long POST query arguments. This issue can be triggered by sending a specially crafted HTTP POST request to the service lcfd.exe listening on TCP port 9495. To trigge...

w-Agora Forum 4.2.1 - Arbitrary File Upload

?php / Title .......................: w-Agora Forum 4.2.1 Remote File Upload Exploit Site ........................: http://www.w-agora.com/en/download.php Version .....................: 4.2.1 Author ......................: Treasure Priyamal Site ........................: http://treasuresec.com...

w-Agora Forum 4.2.1 Arbitrary File Upload Exploit

Exploit for php platform in category web applications ?php / Title .......................: w-Agora Forum 4.2.1 Remote File Upload Exploit Site ........................: http://www.w-agora.com/en/download.php Version .....................: 4.2.1 Author ......................: Treasure Priyamal Si...

w-Agora Forum 4.2.1 - Arbitrary File Upload

w-Agora Forum 4.2.1 - Arbitrary File Upload ?php / Title .......................: w-Agora Forum 4.2.1 Remote File Upload Exploit Site ........................: http://www.w-agora.com/en/download.php Version .....................: 4.2.1 Author ......................: Treasure Priyamal Site...

Sybase M-Business Anywhere agSoap.exe password Tag Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sybase M-Business Anywhere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gsoap.exe module exposed by the webserver that listens by default on TC...

CVE-2011-1580

The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request...

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeE1Menu_Menu.mafService?e1.namespace Cross-Site Scripting

Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - jdeE1MenuMenu.mafService?e1.namespace Cross-Site Scripting source: https://www.securityfocus.com/bid/47479/info Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these...

CVE-2011-1562

Ecava IntegraXor HMI before n 3.60 Build 4032 allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection, but this might not be accurate...

Oracle iSQL*Plus Login Utility

This module attempts to authenticate against an Oracle ISQLPlus administration web site using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE. This module does not require a valid SID, but if one is defined, it will be used. Works against Oracle 9.2, 10.1 ...

HP OpenView NNM nnmRptConfig nameParams Buffer Overflow

Exploit for windows platform in category remote exploits $Id: hpnnmnnmrptconfignameparams.rb 12085 2011-03-23 03:37:18Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more...