7880 matches found
Design/Logic Flaw
register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm...
CVE-2017-9543
The CVE-2017-9543 entry concerns EFS Software Easy Chat Server (versions 2.0–3.1). The underlying issue is in the register.ghp handling, which allows a remote attacker to reset arbitrary user passwords by sending a crafted POST to registresult.htm. Reported impact includes the ability to change p...
SQL Injection
georgringer/news is vulnerable to SQL Injection. A malicious user can send a POST request with the OrderByAllowed parameter or the DateField parameter and an orderBy parameter to inject and execute arbitrary SQL commands. This can only be done if the overrideDemand is set to one which is the...
CVE-2017-9135
An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program...
Weblate: Csrf in watch-unwatch projects
Hello, When you visit any projects from https://hosted.weblate.org/ , there is a button provided on top-right called Watch / Unwatch for each projects. when you click on that button, a POST request is sent which contains csrf token. But this request also works without that token. Just hit the url...
Gratipay: Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat
Summary It is possible to force send invites for gratipay slack channel to arbitary email ids with no bruteforce limit. This is done by modifying the coc parameter to 1 in the POST data sent from https://inside.gratipay.com/appendices/chat Description Sending a post request with coc parameter set...
Sitecore CMS 8.2 - Cross-Site Scripting / Arbitrary File Disclosure
Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: [email protected] Vendor Homepage: http://www.sitecore.net/ Disclaimer: Everything mentioned below is for educational puposes...
Unauthorised Release Deletion
github.com/gogits/gogs is vulnerable to unauthorised release deletions. A malicious user can delete another user's repository releases by modifying a post request...
Uber: phone number exposure for riders/drivers given email/uuid
Hi , Summary I have found one more vulnerable endpoint that is leaking user's phone number when i submit UUID in the request. This attack works for both Driver and Rider. Security Impact We can get any Rider or Driver private phone number by knowing his UUID. Reproduction Steps 1 . Enter victim's...
U.S. Dept Of Defense: reflected xss @ www.█████████
Summary: https://www.██████████/█████████is vulnerable to cross site scripting attacks. PoC Sending the following POST request to /█████ triggers the xss:...
CVE-2017-6619
A vulnerability in the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP inpu...
Coppermine Gallery 1.5.44 Directory Traversal
Coppermine Gallery = 1.5.44 directory traversal vulnerability ============================================================== Coppermine is a multi-purpose fully-featured and integrated web picture gallery script written in PHP using GD or ImageMagick as image library with a MySQL backend. A...
CVE-2016-8726
An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server...
CVE-2017-7185
Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...
CVE-2017-7185
Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Avaya Radvision SCOPIA Desktop SQL Injection
https://www.osisecurity.com.au/avaya-radvision-scopia-desktop-dlgloginowneridjsp-ownerid-sql-injection.html Date: 04-Apr-2017 Product: Avaya Radvision SCOPIA Desktop Versions affected: v7.7.000.042 released in 2011 confirmed v8.2.101.046 relased in 2013 confirmed Vulnerability: Blind SQL injectio...
AlienVault OSSIM/USM < 5.3.6 RCE Vulnerability - Active Check
AlienVault OSSIM and USM are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...
