CVE-2015-0724

Multiple cross-site scripting XSS vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCur25604...

CVE-2015-0734

Multiple cross-site scripting XSS vulnerabilities on the Cisco Email Security Appliance ESA 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a 1 GET or 2 POST request, aka Bug ID CSCut87743...

Novell ZENworks Session ID Disclosure Vulnerability

Novell ZENworks is a suite of software that supports automated IT management and business process management across resources within an organization. A security vulnerability in the Rtrlet.class class of Novell ZENworks allows remote attackers to submit a special POST request to obtain sensitive...

ZYXEL P-660HN-T1H_IPv6 - Remote Configuration Editor Web Server Denial of Service

ZYXEL P-660HN-T1HIPv6 - Remote Configuration Editor Web Server Denial of Service | | | ' | | | | | \r\n" ." | | | | | | | | | | | | | \r\n" ." / || || ||/|| || \r\n" ." \r\n" ." \r\n"; print $banner; function Post$packet,$host try $curl = curlinit; curlsetopt$curl, CURLOPTURL, $host;...

Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection

Unauthenticated SQL injection in ajax call when the plugin is counting the times a product is being seen by the web visitors. The vulnerable POST parameter is "ItemID". Vulnerable code: In file Functions/ProcessAjax.php line 67: ... $ItemID = $POST'ItemID'; $Item = $wpdb-getrow"SELECT ItemViews...

Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability

This vulnerability allows attackers to disclose Session ID's of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. The specific flaw exists within Rtrlet.class. By sending a POST request with the maintenance variable set...

Fedora 20 : glpi-0.84.8-4.fc20 (2015-4516)

Fix privilege escalation via user creation with a crafted POST request Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process

Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...

Johnson Controls Metasys Information Disclosure Vulnerability

Johnson Controls Metasys is a building automation system from Johnson Controls. The system can be networked with weak electronic systems such as fire and security through a variety of open protocols or standard interfaces to provide system integrity for secure access. An information disclosure...

Fedora 22 : glpi-0.85.2-2.fc22 (2015-4690)

Fix privilege escalation via user creation with a crafted POST request Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Joomla! Component com_gallery_wd - SQL Injection

Exploit Title: Joomla Gallery WD - SQL Injection Vulnerability Google Dork: inurl:option=comgallerywd Date: 29.03.2015 Exploit Author: CrashBandicot @DosPerl Vendor HomePage: http://web-dorado.com/ Source Component :...

CVE-2014-5427

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

CVE-2014-5427

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

Project avatar resource vulnerable to XSRF

The project avatar resource accepts content type of MULTIPARTFORMDATA so a malicious attacker could use javascript to submit a form from a foreign host to a stash server and trick the user into changing the project avatar in Stash. cc David Black Atlassian - is there any reason why panopticon fou...

Mastery oa at the secondary injection vulnerability-vulnerability warning-the black bar safety net

Brief description: Paralysis of the software Detailed description: ! QQ 图片 20141215110029.jpg Add the attention of the people, many functions rely on the data code area POST http://121.40.134.14/general/personinfo/concernuser/update.php HTTP/1.1 Host: 121.40.134.14 Connection: keep-alive...

某信息发布系统SQL注入(demo复现)

简要描述： 某信息发布系统SQL注入demo复现 详细说明： 某信息发布系统SQL注入demo复现 漏洞证明： 注入在这个地方： 抓包看看： POST /index.php HTTP/1.1 Host: pmbdemo.youyax.com Proxy-Connection: keep-alive Content-Length: 21 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Origin:...

Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability

A vulnerability in Cisco Unified Web Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to a lack of input sanitization of the Cisco Unified Web...

CVE-2015-0655

Cross-site scripting XSS vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184...

Cross site scripting

Cross-site scripting XSS vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184...

CVE-2015-0655

CVE-2015-0655 affects Cisco Unified Web and E‑Mail Interaction Manager (Unified Web Interaction Manager). The vulnerability is an XSS due to lack of input sanitization, exploitable by an unauthenticated, remote attacker who entices a user to submit a crafted POST request to the web interface. Imp...