Directory traversal

Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. dot dot in a /CIMListener/ URI in an M-POST request...

CVE-2009-0879

The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of service daemon crash via a long consumer name, as demonstrated by an M-POST request to a long /CIMListener/ URI...

CVE-2009-0880

Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. dot dot in a /CIMListener/ URI in an M-POST request...

CVE-2008-6395

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

Cross site request forgery (csrf)

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

CVE-2008-6395

The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause a denial of service device crash via a malformed HTTP POST request...

Apache Tomcat information leak

Under some conditions it's possible to retrieve data from previous POST request...

E107 CMS (e107_plugins/guestbook) stored XSS

Фильтрация отсутствует в поле "Email", POST запрос: POSTDATA=name=1&email='/"scriptalert'xss'/script&url=http3A2F2F&comment=4&guestbooksubmit=SiC5B3sti Далее следует редактирование сообщения. http://Target/e107plugins/guestbook/guestbook.php?edit.номер вашего сообщения Example:...

Novell GroupWise < 7.03HP2 / 8.0HP1 WebAccess Multiple XSS

The version of Novell GroupWise WebAccess installed on the remote host fails to sanitize user-supplied input via a POST request to the 'User.id' parameter of the '/gw/webacc' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to inject arbitrary...

Cross-Site Scripting vulnerability in Drupal

Здравствуйте 3APA3A! Сообщаю вам о найденной мною ещё 12.11.2007 Cross-Site Scripting уязвимости в Drupal. XSS: POST запрос на странице http://site/user/password BODY onload="a='alert';b='document.cookie';evala+b;" В полях: Username и E-mail address. Уязвимы старые версии Drupal. Дополнительная...

CVE-2002-2429

webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service daemon crash via an HTTP POST request that contains a negative integer in the Content-Length header...

Cross site request forgery (csrf)

The Cisco Wireless LAN Controller WLC, Cisco Catalyst 6500 Wireless Services Module WiSM, and Cisco Catalyst 3750 Integrated Wireless LAN Controller with software 4.x before 4.2.176.0 and 5.2.x before 5.2.157.0 allow remote attackers to cause a denial of service device reload via a web...

glFusion 1.1 - Anonymous Comment Username HTML Injection

glFusion 1.1 - Anonymous Comment Username HTML Injection source: https://www.securityfocus.com/bid/33683/info glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of th...

glFusion 1.1 - Anonymous Comment 'Username' HTML Injection

source: https://www.securityfocus.com/bid/33683/info glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to ste...

Design/Logic Flaw

Mozilla Firefox 3.x before 3.0.6 does not properly implement the 1 no-store and 2 no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the a back button or b history list of the victim's browser, as demonstrated by reading the response page of an...

PR08-23: XSS on Novell GroupWise WebAccess

PR08-23: XSS on Novell GroupWise WebAccess Vulnerability found: 2nd October 2008 Vendor contacted: 3rd October 2008 Advisory publicly released: 30th January 2009 Severity: Medium Credits: Richard Brain of ProCheckUp Ltd www.procheckup.com. ProCheckUp thanks Novell for working with us in such a...

KTorrent PHP Code Injection And Security Bypass Vulnerability

KTorrent is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...

DEBIAN-CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...

CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request...