Symantec Web Gateway 5.1.1.24 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in Symantec WEB Gateway 5.1.1.24 II. BACKGROUND ------------------------- Symantec Corporation is an American computer security, backup and availability solutions software corporation headquartered in Mountain View,...

Cisco Secure ACS Portal Interface Session Hijacking

The version of Cisco Secure Access Control System ACS on the remote host is affected by a vulnerability in the Portal Interface. Due to insufficient session management, this could allow a remote, authenticated attacker to perform actions in the portal with the privileges of another user. C Tenabl...

FortiWeb 5.0.3 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected vulnerabilities in OS of FortiWeb v 5.0.3 CVE-2013-7181 II. BACKGROUND ------------------------- Fortinet's industry-leading, Network Security Platforms deliver Next Generation Firewall NGFW security with exceptional throughput, ultra low...

JBoss Portal 6.1.0 Update (RHSA-2013:1437)

The version of JBoss Enterprise Portal Platform on the remote system is affected by the following issues: - A flaw in CSRF prevention filter in JBoss Web could allow remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

pfSense 2.1 build 20130911-1816 - Directory Traversal

pfSense version 2.1 suffers from local file inclusion, privilege escalation, and directory traversal vulnerabilities. | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users...

pfSense 2.1 build 20130911-1816 - Directory Traversal

pfSense 2.1 build 20130911-1816 - Directory Traversal | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya...

pfSense 2.1 build 20130911-1816 - Directory Traversal

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya Morimoto Software Link: www.pfsense.org Category: Local...

pfSense 2.1 Inclusion / Traversal / Escalation

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya Morimoto Software Link: www.pfsense.org Category: Local...

otrs -- multiple vulnerabilities

The OTRS Project reports: SQL injection issue An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks...

CVE-2014-0678

CVE-2014-0678 affects Cisco Secure Access Control System (ACS) Portal Interface. The vulnerability stems from insufficient session management in the portal, allowing an authenticated remote attacker to hijack a user’s session and perform actions with the other user’s privileges. Cisco acknowledge...

PT-2014-3773

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System ACS affected versions not specified Description The issue concerns the portal interface in Cisco Secure Access Control System ACS that does not properly manage sessions. This allows remote authenticated users...

CVE-2014-0678: Undefined Security Weakness

The portal interface in Cisco Secure Access Control System ACS does not properly manage sessions, which allows remote authenticated users to hijack sessions and gain privileges via unspecified vectors, aka Bug ID CSCue65951...

[Subterfuge v1.0] Automated Man-in-the-Middle Attack Framework

Subterfuge , a Framework to take the arcane art of Man-in-the-Middle Attacks and make it as simple as point and shoot. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network and even exploiting machines by injecting malicious code directly...

CVE-2013-4200 - Plone URL redirection / Forwarding of cookie data (session hijack) in certain browsers

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart [email protected]...

Conceptronic C54APM多个反射型跨站脚本漏洞

CVE ID:CVE-2013-1407 Conceptronic C54APM是一款无线AP设备。 Conceptronic C54APM存在多个反射型跨站脚本漏洞，允许远程攻击者构建恶意URI，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。漏洞是由于goform/formWlSiteSurvey脚本不正确过滤submit-url参数，及goform/formWlanSetup脚本不正确过滤wlan-url参数引起的。 0 Conceptronic C54APM v2.0 1.26 目前没有详细解决方案提供：...

Open-Xchange Security Advisory 2014-01-06

Open-Xchange Security Advisory 2014-01-06 Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30203 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.0 and earlier Vulnerable component: backend Fixe...

Built2Go PHP Shopping - Cross-Site Request Forgery (Admin Password)

Built2Go PHP Shopping - Cross-Site Request Forgery Admin Password source: https://www.securityfocus.com/bid/64735/info Built2Go PHP Shopping is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to use a victim's currently active session to chan...

CVE-2014-0651: Undefined Security Weakness

The administrative interface in Cisco Context Directory Agent CDA does not properly enforce authorization requirements, which allows remote authenticated users to obtain administrative access by hijacking a session, aka Bug ID CSCuj45347...

PT-2014-3746

Name of the Vulnerable Software and Affected Versions Cisco Context Directory Agent CDA affected versions not specified Description The administrative interface in Cisco Context Directory Agent CDA does not properly enforce authorization requirements. This allows remote authenticated users to...

[Ghost Phisher v1.5] GUI suite for phishing and penetration attacks

Ghost Phisher is an application of security which comes built-in with a fake DNS server ,DHCP server fake, fake HTTP Server and also has a space for the automatic capture and recording credentials HTTP method of the form to a database. The program could be used for on-demand service of DHCP, DNS,...