Barracuda SSL VPN 680 - returnTo Open Redirection

Barracuda SSL VPN 680 - returnTo Open Redirection source: https://www.securityfocus.com/bid/60172/info Barracuda SSL VPN 680 is prone to an open-redirection vulnerability. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting vict...

Barracuda SSL VPN 680 - 'returnTo' Open Redirection

source: https://www.securityfocus.com/bid/60172/info Barracuda SSL VPN 680 is prone to an open-redirection vulnerability. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an...

Spoofing

Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."...

Microsoft Windows Essentials CVE-2013-0096 URI Handling Information Disclosure Vulnerability

Description Microsoft Windows Essentials is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows Essentials 2011 Microsoft Windows Essentials 2012 Recommendations...

Windows Live Essentials Improper URI Handling Vulnerability (MS13-045; CVE-2013-0096)

An information disclosure vulnerability exists when Windows Live Writer fails to properly handle a specially crafted URL. An attacker who successfully exploited this vulnerability could perform various actions on behalf of the logged-on user. These actions include the ability to overwrite files a...

e107 content_preset.php URI XSS

The version of e107 installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user input passed in the URI to the 'contentpreset.php' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user'...

Wordpress Securimage-WP Plugin v3.2.4 URI-based XSS Vulnerability

Summary Securimage-WP adds powerful CAPTCHA protection to comment forms on posts and pages to help prevent comment spam from getting onto your site. Description Securimage-WP suffers from a XSS issue in 'siwptest.php' that uses the 'PHPSELF' variable. The vulnerability is present because there...

[SECURITY] Fedora 19 Update: libxml2-2.9.1-1.fc19

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

[SECURITY] Fedora 18 Update: libxml2-2.9.1-1.fc18

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

IIS 7.5 解析错误 命令执行漏洞

IIS是由微软公司提供的基于运行Microsoft Windows的互联网基本服务，其7.0、7.5版本在URI中出现xxx.jpg/xxx.php这样形式的访问时与后端FastCGI处理不一致，导致攻击者可以通过在图片中嵌入PHP代码，然后以xxx.jpg/xxx.php的形式来访问图片，IIS就会执行图片中的PHP代码，导致命令执行漏洞。 IIS 7.0、7.5...

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

Cross site request forgery (csrf)

HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files...

CVE-2013-0470

HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files...

Lotus Domino 8.5.4 Cross Site Scripting

Hello list! I want to warn you about multiple Cross-Site Scripting vulnerabilities in IBM Lotus Domino. Last year I've announced multiple vulnerabilities in IBM software and after IBM fixed many of them, I've disclosed them. These are new vulnerabilities in Domino, which I've found at 03.05.2012...

Apache HTTPD mod_proxy_balancer Cross Site Scripting (CVE-2012-4558)

A cross site scripting vulnerability exists in Apache HTTP web server modproxybalancer. The vulnerability is due to a lack of input validation in the URI of the modproxybalancer manager interface. A remote attacker can exploit these vulnerabilities by enticing a user to follow a specially crafted...

WordPress IndiaNIC FAQs Manager Plugin 1.0 - Blind SQL Injection

The "order" and "orderby" parameter is vulnerable for SQL Injection Example URL: http://127.0.0.1:9001/wordpress/wp-admin/admin.php?page=3Din= icfaq&orderby=3D PoC take some time to finish 15min on my Testsystem. I could speed it up with Multithreading but I'm to lazy right now Vulnerable code pa...

WordPress IndiaNIC FAQS Manager 1.0 SQL Injection

Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection Google Dork: inurl:wp-content/plugins/faqs-manager Date: 21.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/ Software Link:...

CVE-2013-0716

The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service daemon crash via a crafted URI...

Code injection

The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service daemon crash via a crafted URI...

CVE-2013-0716

The CVE-2013-0716 issue affects Wind River VxWorks Web Server (versions 5.5 through 6.9). It is a DoS vulnerability in the Web Server component where a specially crafted URL can cause the Web Server to crash (denial of service). The underlying cause is described as an improper input handling/vali...