CVE-2017-1000141

CVE-2017-1000141 affects Mahara before 18.10.0. The issue involves mishandling user requests that could remove a user’s ability to manage their own account (e.g., changing username, changing the primary email, or deleting the account). The described correct behavior is to require password verific...

CVE-2017-1000141

An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account changing username, changing primary email address, deleting account. The correct behavior was to either prompt them for their password and/or send a...

CVE-2017-12272

CVE-2017-12272 affects Cisco IOS XE Software Web Framework, where insufficient input validation in the web server enables unauthenticated, remote attackers to perform a cross-site scripting (XSS) attack. The exploit requires the victim to visit a malicious link or for an attacker to intercept a u...

CVE-2017-12838

Cross-site request forgery CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of users for requests that 1 send manas via a request to mybonus.php or 2 add administrators via unspecified vectors...

Symantec Endpoint Protection Manager Cross Site Request Forgery (CVE-2016-3653)

A Cross Site Request Forgery vulnerability has been reported in the Symantec Endpoint Protection Manager. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to visit a page. Successful exploitation could...

Important: Red Hat Security Advisory: pcs security update

Updated pcs packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available f...

[SECURITY] Fedora 22 Update: rt-4.2.10-2.fc22

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitt ed by a community of users...

Sun Java System Application Server 7.0/8.0 - Remote Installation Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10424/info It is reported that Java System Application Server is prone to a remote installation path disclosure vulnerability. This issue is due to a failure of the application to properly filter user requests. Successful...

TIPS MailPost 5.1.1 - Remote File Enumeration Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11599/info TIPS MailPost is affected by a remote file enumeration vulnerability. This issue is due to a failure to properly sanitize user requests. An attacker may leverage this issue to gain knowledge of the existence of...

[SECURITY] Fedora 10 Update: rt3-3.8.2-12.fc10

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitt ed by a community of users...

[SECURITY] Fedora 10 Update: rt3-3.8.2-11.fc10

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitt ed by a community of users...

Fixed in Apache Tomcat JK Connector 1.2.27

Important: Information disclosure CVE-2008-5519 Situations where faulty clients set Content-Length without providing data, or where a user submits repeated requests very quickly, may permit one user to view the response associated with a different user's request. This was fixed in revision 702540...

HP OpenView Network Node Manager Message Handling Buffer Overflow (CVE-2008-1842)

The Network Node Manager NNM is an HP OpenView product which manages networks. It determines and displays physical and logical connectivity in networks, as well as information referring to protocols running over the network. A buffer overflow vulnerability has been discovered in HP OpenView Netwo...

Link Request Contact Form任意文件上传漏洞

Link Request Contact Form允许用户请求向其他站点添加自己站点的链接横幅。 Link Request Contact Form在处理文件上传时存在漏洞，远程攻击者可能利用此漏洞上传恶意脚本执行代码。 Link Request Contact Form的output.php脚本没有验证所上传文件的扩展名，因此攻击者可以上传有.php扩展名的文件然后在服务器上执行任意PHP代码。成功攻击要求在HTTP头中传送允许的MIME媒体类型。 American Financing Link Request Contact Form 3.4 American Financing...

TIPS MailPost 5.1.1 - Remote File Enumeration

source: https://www.securityfocus.com/bid/11599/info TIPS MailPost is affected by a remote file enumeration vulnerability. This issue is due to a failure to properly sanitize user requests. An attacker may leverage this issue to gain knowledge of the existence of files outside the Web root...

SAFE TEAM Regulus 2.2 - Staffile Information Disclosure

SAFE TEAM Regulus 2.2 - Staffile Information Disclosure source: https://www.securityfocus.com/bid/11132/info SAFE TEAM Regulus is reported prone to an information disclosure vulnerability. It is reported that any user may make a request for the Regulus 'staffile' file hosted on a target server...

CVE-2003-0556

Polycom MGC 25 allows remote attackers to cause a denial of service crash via a large number of "user" requests to the control port 5003, as demonstrated using the blast TCP stress tester...

Дырка в xchat

Не комментируются shell-символы в запросе пользователя, что делает возможным выполнение кода на сервере...