10025 matches found
Weblate: Csrf in watch-unwatch projects
Hello, When you visit any projects from https://hosted.weblate.org/ , there is a button provided on top-right called Watch / Unwatch for each projects. when you click on that button, a POST request is sent which contains csrf token. But this request also works without that token. Just hit the url...
Gratipay: Unauthorized access to the slack channel via inside.gratipay.com/appendices/chat
Summary It is possible to force send invites for gratipay slack channel to arbitary email ids with no bruteforce limit. This is done by modifying the coc parameter to 1 in the POST data sent from https://inside.gratipay.com/appendices/chat Description Sending a post request with coc parameter set...
PT-2017-18533
Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue allows an attacker to bypass the Same Origin Policy by sending a POST request to the "home/seos/courier/web/wmProgressstat.html.php" endpoint with an attacker domain in the...
CVE-2017-8793: Origin Validation Error
An issue was discovered on Accellion FTA devices before FTA912180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attacker domain in the acallow parameter, the device will respond with an Access-Control-Allow-Origin header allowing the attacker to have site...
Sitecore CMS 8.2 - Cross-Site Scripting / Arbitrary File Disclosure
Exploit title: Sitecore CMS v8.2 multiple vulnerabilities Product: Sitecore Version: 8.2, Rev: 161221, Date: 21st December, 2016 Date: 05-05-2017 Author: Usman Saeed Email: [email protected] Vendor Homepage: http://www.sitecore.net/ Disclaimer: Everything mentioned below is for educational puposes...
Unauthorised Release Deletion
github.com/gogits/gogs is vulnerable to unauthorised release deletions. A malicious user can delete another user's repository releases by modifying a post request...
Uber: phone number exposure for riders/drivers given email/uuid
Hi , Summary I have found one more vulnerable endpoint that is leaking user's phone number when i submit UUID in the request. This attack works for both Driver and Rider. Security Impact We can get any Rider or Driver private phone number by knowing his UUID. Reproduction Steps 1 . Enter victim's...
U.S. Dept Of Defense: reflected xss @ www.█████████
Summary: https://www.██████████/█████████is vulnerable to cross site scripting attacks. PoC Sending the following POST request to /█████ triggers the xss:...
CVE-2017-6619
A vulnerability in the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP inpu...
Coppermine Gallery 1.5.44 Directory Traversal
Coppermine Gallery = 1.5.44 directory traversal vulnerability ============================================================== Coppermine is a multi-purpose fully-featured and integrated web picture gallery script written in PHP using GD or ImageMagick as image library with a MySQL backend. A...
CVE-2016-8726
An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web server...
CVE-2017-7185
Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...
CVE-2017-7185
Use-after-free vulnerability in the mghttpmultipartwaitforboundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service crash via a multipart/form-data POST request without a MIM...
PT-2017-8688
Name of the Vulnerable Software and Affected Versions OXID eShop versions prior to 5.1.12, 5.2.9, 4.8.12, and 4.9.9 Description The issue allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Recommendations For versions prior to 5.1.12, update to...
CVE-2016-5072: Improper Control of Generation of Code
OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...
Moxa AWK-3131A web_runScript Header Manipulation Denial of Service Vulnerability
Summary An exploitable null pointer dereference vulnerability exists in the Web Application /forms/webrunScript iwfilename functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. An HTTP POST request with a blank line in the header will cause a segmentation fault in the web...
Avaya Radvision SCOPIA Desktop SQL Injection
https://www.osisecurity.com.au/avaya-radvision-scopia-desktop-dlgloginowneridjsp-ownerid-sql-injection.html Date: 04-Apr-2017 Product: Avaya Radvision SCOPIA Desktop Versions affected: v7.7.000.042 released in 2011 confirmed v8.2.101.046 relased in 2013 confirmed Vulnerability: Blind SQL injectio...
AlienVault OSSIM/USM < 5.3.6 RCE Vulnerability - Active Check
AlienVault OSSIM and USM are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...
