Connect "_method"跨站脚本漏洞

Connect是一款基于WEB的应用。 Connect不正确过滤"method" POST参数数据，允许远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Connect 2.x Connect 2.8.1版本已修复该漏洞，建议用户下载使用： https://github.com/senchalabs/connect...

WordPress Unconfirmed Plugin 's'插件跨站脚本漏洞

Bugtraq ID:66781 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 WordPress Unconfirmed插件不正确过滤's'参数，远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 WordPress Unconfirmed Plugin 1.2.4 WordPress Unconfirmed 1.2.5版本已修复该漏洞，建议用户下载使用： http://wordpress.org/plugins/unconfirmed...

XCloner Standalone跨站请求伪造漏洞

Bugtraq ID:65751 CVE ID:CVE-2014-2579 XCloner Standalone是一个备份和恢复应用。 XCloner Standalone存在跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 XCloner Standalone 3.5 目前没有详细解决方案： http://www.xcloner.com/...

CubeCart会话固定漏洞

CubeCart是一个购物车程序。 CubeCart处理会话存在错误，允许攻击者构建恶意URI，诱使用户解析，可劫持其他用户会话，登录应用系统。 0 CubeCart 5.x CubeCart 5.2.9版本已修复该漏洞，建议用户下载使用： http://www.cubecart.com...

CVE-2014-2869

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

CVE-2014-2869

PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to obtain sensitive information via requests to unspecified URIs, as demonstrated by pathname, SQL server, e-mail address, and IP address information...

Framework: cross-site scripting flaw when using Spring MVC

Cross-site scripting XSS vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action...

Framework: cross-site scripting flaw when using Spring MVC

Cross-site scripting XSS vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action...

Code injection

Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service card reload via a crafted HTTP URI, aka Bug ID CSCun06870...

CVE-2014-2142

CVE-2014-2142 affects Cisco ONS 15454 Controller Cards; the vulnerability stems from incorrect parsing of the HTTP URI in the web interface, allowing an unauthenticated remote attacker to trigger a card reload and cause a DoS. Affected software: Cisco ONS 15454 controller cards with software vers...

CVE-2014-2142

Cisco ONS 15454 controller cards with software 10.0 and earlier allow remote attackers to cause a denial of service card reload via a crafted HTTP URI, aka Bug ID CSCun06870...

Redmine未明开放重定向漏洞

Redmine是用Ruby开发的基于web的项目管理软件，是用ROR框架开发的一套跨平台项目管理系统。 Redmine不正确过滤用户输入，允许攻击者构建恶意URI，诱使用户解析，可重定向用户通信，进行网络钓鱼等攻击。 0 Redmine 2.x Redmine 2.5.1或2.4.5版本已修复该漏洞，建议用户下载使用： http://www.redmine.org/...

Cisco ONS 15454控制卡HTTP URI拒绝服务漏洞

Bugtraq ID:66686 CVE ID:CVE-2014-2142 Cisco ONS 15454是一款多业务传输平台。 Cisco ONS 15454控制卡WEB接口存在安全漏洞，由于不正确解析HTTP URI，允许攻击者发送特制的HTTP请求，可使控制卡重载。 0 Cisco ONS 15454 System Software 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2142...

Important: libyaml

Issue Overview: Heap-based buffer overflow in the yamlparserscanuriescapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file. Affected Packages: libyaml Issue Correction: Run yum...

MediaWiki 'Special:ChangePassword'跨站请求伪造漏洞

Bugtraq ID:66600 CVE ID:CVE-2014-2665 MediaWiki是一款Wiki程序。 MediaWiki 'Special:ChangePassword'存在跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作。 0 MediaWiki 1.22.5 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： https://bugzilla.wikimedia.org/showbug.cgi?id=62497...

Cisco ONS 15454 Controller Card Denial of Service Vulnerability

A vulnerability in the web interface of Cisco ONS15454 controller cards could allow an unauthenticated, remote attacker to cause the control card to reset. The vulnerability is due to incorrect parsing of the HTTP URI. An attacker could exploit this vulnerability by sending specific HTTP requests...

Yahoo!: Header injection on rmaitrack.ads.vip.bf1.yahoo.com

Thank you for your submission to the Yahoo Bug Bounty program. We were able to reproduce the issue you reported and have implemented appropriate fixes. We appreciate your adherence to responsible disclosure guidelines and look forward to your future participation in the program. header injection ...

RSA Adaptive Authentication (On-Premise)跨站脚本漏洞

CVE ID:CVE-2014-0637 RSA Adaptive Authentication是一款多用于大型金融机构的集中的、多层的认证解决方案。 RSA Adaptive Authentication存在跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 RSA Adaptive Authentication On-Premise 6.x RSA Adaptive Authentication On-Premise 7.x RSA Adaptive Authentication On-Premise 7.1 SP0...

Pearson eSIS 'loginverification.aspx'跨站脚本漏洞

Bugtraq ID:66562 CVE ID:CVE-2014-1942 Pearson eSIS Enterprise Student Information System是一个相关学生信息系统的管理系统。 Pearson eSIS Enterprise Student Information System /aal/loginverification.aspx存在反射型跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 Pearson eSIS 目前没有详细解决方案：...

MGASA-2014-0156 Updated ruby-rack-ssl packages fix CVE-2014-2538

Updated ruby-rack-ssl packages fix security vulnerabilities: Cross-site scripting XSS vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters su...