HP Service Manager多个安全漏洞

CVE ID:CVE-2013-1493、CVE-2013-2067、CVE-2013-6202 HP Service Manager是一款软件即服务可以帮助您迅速部署一个全面的IT 服务管理解决方案。 HP Service Manager存在多个安全漏洞： 1，不正确过滤返回给用户的输入，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 2，应用程序存在跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 3，存在未明错误，允许攻击者利用漏洞执行任意代码，目前没有详细漏洞细节提供。...

Barracuda Networks Backup - Persistent Web Vulnerability

Document Title: =============== Barracuda Networks Backup - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=784 BARRACUDA NETWORK SECURITY ID: BNSEC-885 Release Date: ============= 2014-02-25 Vulnerability Laboratory ID VL-ID...

IBM Rational Focal Point未明多个安全漏洞

CVE ID:CVE-2014-0839、CVE-2014-0840、CVE-2014-0842、CVE-2014-0843、CVE-2014-0853 IBM Rational Focal Point是IBM Rational基于Web的产品管理系统，内置了面向客户和市场的产品管理流程，提供产品管理过程中的工作流自动化、信息相关性分析、信息统计分析以及信息的优先级分析功能。 IBM Rational Focal Point存在多个安全漏洞： 1，不正确过滤部分用户输入，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。...

Jenkins < 1.551 / 1.532.2 and Jenkins Enterprise 1.509.x / 1.532.x < 1.509.5.1 / 1.532.2.2 Multiple Vulnerabilities

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is affected by multiple vulnerabilities : - A flaw in the default markup formatter allows cross-site scripting via the Description field in the user configuration. CVE-2013-5573 - A security bypass vulnerability allows...

CNNVD Cross Site Scripting

Document Title: =============== CNNVD Gov CN 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1209 Release Date: ============= 2014-02-21 Vulnerability Laboratory ID VL-ID: ====================================...

CNNVD Gov CN #1 - Filter Bypass & Persistent Vulnerability

Document Title: =============== CNNVD Gov CN 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1209 Release Date: ============= 2014-02-21 Vulnerability Laboratory ID VL-ID: ====================================...

Design/Logic Flaw

Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token...

CVE-2014-1219

CA 2E Web Option (r8.1.2) is affected by CVE-2014-1219 due to a predictable session token, W2E_SSNID, enabling unauthenticated privilege escalation by manipulating the end digits to hijack or terminate sessions. Affected product/version: CA 2E Web Option r8.1.2 (and potentially others). Root caus...

DELL SonicWALL Universal Management Suite 7.1 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in DELL SonicWALL Universal Management Suite v7.1 II. BACKGROUND ------------------------- DellR SonicWALLR provides intelligent network security and data protection solutions that enable customers and partners to...

Symantec Web Gateway 5.1.1.24 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in Symantec WEB Gateway 5.1.1.24 II. BACKGROUND ------------------------- Symantec Corporation is an American computer security, backup and availability solutions software corporation headquartered in Mountain View,...

Cisco Secure ACS Portal Interface Session Hijacking

The version of Cisco Secure Access Control System ACS on the remote host is affected by a vulnerability in the Portal Interface. Due to insufficient session management, this could allow a remote, authenticated attacker to perform actions in the portal with the privileges of another user. C Tenabl...

FortiWeb 5.0.3 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected vulnerabilities in OS of FortiWeb v 5.0.3 CVE-2013-7181 II. BACKGROUND ------------------------- Fortinet's industry-leading, Network Security Platforms deliver Next Generation Firewall NGFW security with exceptional throughput, ultra low...

JBoss Portal 6.1.0 Update (RHSA-2013:1437)

The version of JBoss Enterprise Portal Platform on the remote system is affected by the following issues: - A flaw in CSRF prevention filter in JBoss Web could allow remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

pfSense 2.1 build 20130911-1816 - Directory Traversal

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya Morimoto Software Link: www.pfsense.org Category: Local...

pfSense 2.1 build 20130911-1816 - Directory Traversal

pfSense 2.1 build 20130911-1816 - Directory Traversal | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya...

pfSense 2.1 build 20130911-1816 - Directory Traversal

pfSense version 2.1 suffers from local file inclusion, privilege escalation, and directory traversal vulnerabilities. | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users...

otrs -- multiple vulnerabilities

The OTRS Project reports: SQL injection issue An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks...

pfSense 2.1 Inclusion / Traversal / Escalation

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya Morimoto Software Link: www.pfsense.org Category: Local...

CVE-2014-0678

CVE-2014-0678 affects Cisco Secure Access Control System (ACS) Portal Interface. The vulnerability stems from insufficient session management in the portal, allowing an authenticated remote attacker to hijack a user’s session and perform actions with the other user’s privileges. Cisco acknowledge...

[Subterfuge v1.0] Automated Man-in-the-Middle Attack Framework

Subterfuge , a Framework to take the arcane art of Man-in-the-Middle Attacks and make it as simple as point and shoot. Subterfuge demonstrates vulnerabilities in the ARP Protocol by harvesting credentials that go across the network and even exploiting machines by injecting malicious code directly...