9476 matches found
CVE-2014-2233
Server-side request forgery SSRF vulnerability in the MapAPI in Infoware MapSuite before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to trigger requests to intranet servers via unspecified vectors...
CVE-2014-2233
CVE-2014-2233 (Infoware MapSuite MapAPI) is a Server-Side Request Forgery (SSRF) vulnerability in MapSuite MapAPI that allows an attacker to trigger requests from the vulnerable server to internal/intranet targets via specially crafted input parameters. Affected versions are MapAPI prior to 1.0.3...
Server side request forgery (ssrf)
The respjsippubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service crash via crafted headers in a SIP SUBSCRIBE request for an event package...
CVE-2014-9038
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery SSRF attacks by referring to a 127.0.0.0/8 resource...
CVE-2014-9038
wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery SSRF attacks by referring to a 127.0.0.0/8 resource...
WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities
According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities : - Multiple unspecified errors exist that could allow cross-site scripting attacks. - An unspecified error exists that could allow cross-site request forgery...
Server side request forgery (ssrf)
The Best Free Giveaways aka com.wIphone5GiveAways application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Server side request forgery (ssrf)
Bulb Security Smartphone Pentest Framework SPF before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request...
Server side request forgery (ssrf)
The Quest Federal CU Mobile aka com.metova.cuae.questfcu application 1.0.27 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Open-Xchange Security Advisory 2014-09-15
Product: OX App Suite Vendor: Open-Xchange GmbH Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.6.0 and earlier Vulnerable component: frontend Fixed version: 7.4.2-rev33, 7.6.0-rev16 Report confidence: Confirmed Solution status: Fixed by Vendor Vendor notification: 2014-07-1...
Server side request forgery (ssrf)
The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery SSRF attacks via crafted serialized data in the report parameter...
Server side request forgery (ssrf)
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...
X2Engine 4.1.7 PHP Object Injection
------------------------------------------------------------------------- X2Engine = 4.1.7 SiteController.php PHP Object Injection Vulnerability ------------------------------------------------------------------------- - Software Link: http://www.x2engine.com/ - Affected Versions: All versions fr...
Server side request forgery (ssrf)
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request...
Alfresco - proxy?endpoint Server-Side Request Forgery
Alfresco - proxy?endpoint Server-Side Request Forgery source: https://www.securityfocus.com/bid/68/info http://www.example.com/alfresco/proxy?endpoint=http://internalsystem:port 663/info Alfresco Community Edition is prone to multiple security vulnerabilities. An attacker may leverage these issue...
Traidnt UP 2.0 - Remote SQL Injection Exploit
No description provided by source. !/usr/bin/ruby ============================================= Traidnt UP v2.0 Exploit SQL Injection Vulnerability --------------------------------------------- Date: 05-08-2009 Discovered & written by: Jafer Al-Zidjali Email: jaferatscorpionds.com Website:...
CVE-2014-2232 - "Absolute Path Traversal" (CWE-36) vulnerability in "infoware MapSuite"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2232 =================== "Absolute Path Traversal" CWE-36 vulnerability in "infoware MapSuite" Vendor =================== infoware GmbH Product =================== MapSuite Affected versions =================== This vulnerability affects...
CVE-2014-2233 - "Server-Side Request Forgery" (CWE-918) vulnerability in "infoware MapSuite"
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2233 =================== "Server-Side Request Forgery" CWE-918 vulnerability in "infoware MapSuite" Vendor =================== infoware GmbH Product =================== MapSuite Affected versions =================== This vulnerability affects...
Server side request forgery (ssrf)
PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request...
Server side request forgery (ssrf)
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service assertion failure via a crafted range request, related to state management...