Local Privilege Escalation in Management Web Interface

A vulnerability exists in the Management web interface that could allow local privilege escalation. The Management web interface does not properly validate specific request parameters, which can potentially allow deletion of files in the system. Ref. PAN-90954; CVE-2018-9242 Successful exploitati...

The vulnerability of the NmAPI.exe executable of the WhatsUp Gold network infrastructure monitoring system allows a perpetrator to gain unauthorized access to the WhatsUp Gold system or execute remote commands.

The vulnerability of the NmAPI.exe executable of the WhatsUp Gold network infrastructure monitoring system is related to insufficient checking of incoming requests. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to the WhatsUp Gold system, disclose sensitive...

CVE-2018-0299

A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service DoS condition. The vulnerability is due to...

Apache httpd mod_cache_socache Denial of Service (CVE-2018-1303)

A denial-of-service vulnerability exists in Apache httpd. The vulnerability is due to improper validation of the headers in HTTP requests...

RCE with spring-security-oauth2 分析(CVE-2018-1260)

漏洞公告 环境搭建 利用github上已有的demo： git clone https://github.com/wanghongfei/spring-security-oauth2-example.git 确保导入的spring-security-oauth2为受影响版本，以这里为例为2.0.10 进入spring-security-oauth2-example，修改 cn/com/sina/alan/oauth/config/OAuthSecurityConfig.java的第67行: @Override public void...

Microsoft ASP.NET Core Remote Elevation of Privilege Vulnerability

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft Corporation USA. The framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. A privilege vulnerability exists in Microsoft ASP.NET Core version 2.0, which...

Rapid7 Nexpose Cross-Site Request Forgery Vulnerability

Rapid7 Nexpose is a suite of vulnerability management software from Rapid7 USA that can synthesize different scans to deeply probe a network. The software proactively scans configuration environments for errors, vulnerabilities, malware and provides guidance to reduce risk. A security vulnerabili...

CVE-2017-11932

Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access OWA validates web requests, aka "Microsoft Exchange Spoofing Vulnerability"...

CVE-2017-11932

Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access OWA validates web requests, aka "Microsoft Exchange Spoofing Vulnerability"...

Cross site scripting

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...

CVE-2017-13994

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...

CVE-2017-13994

A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allow XSS attacks to occur if an authenticated user of the web interface is tricked into clicking a malicious link...

OSIsoft PI Web API Cross-Site Request Forgery Vulnerability

The OSIsoft PI Web API is a product for accessing PI system data. A cross-site request forgery vulnerability exists in the OSIsoft PI Web API. As the program fails to properly validate HTTP requests. An attacker could exploit the vulnerability to perform certain unauthorized actions and access th...

Cross-Site Request Forgery Vulnerability in Multiple IBM Products (CNVD-2017-10743)

IBM Global Retention Policy and Schedule Management is a single retention management system. An unspecified cross-site request forgery vulnerability exists in multiple IBM products, which stems from a program's failure to properly validate HTTP requests. A remote attacker could exploit the...

CVE-2017-0247

The CVE affects Microsoft ASP.NET Core: a DoS vulnerability caused by improper validation of web requests in the TextEncoder.EncodeCore function. It applies to ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3, where remote attackers could trigger DoS by exploiting incorrect calculation of the...

NetIQ Access Manager Cross-Site Request Forgery Vulnerability

NetIQ Access Manager NAM is a set of resource access solution developed by NetIQ Inc. in the United States. It provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site request forgery vulnerability exists in NetIQ Access Manager due to...

IBM Security Identity Manager Cross-Site Request Forgery Vulnerability (CNVD-2017-04428)

IBMSecurityIdentityManager ISIM is a suite of identity management and governance solutions from IBM, USA. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password management. A cross-si...

Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (CNVD-2017-03854)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site request forgery vulnerability...

Cross site request forgery (csrf)

An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information...

IBM Security Access Manager Cross-Site Request Forgery Vulnerability (CNVD-2017-01308)

IBM Security Access Manager is a security access manager from IBM USA. IBM Security Access Manager suffers from an unspecified cross-site scripting request forgery vulnerability that stems from a failure to adequately validate HTTP requests. An attacker could use this vulnerability to perform...