Embedthis Goahead WebServer 3.1.3-0 - Multiple Vulnerabilities

Title: Embedthis Goahead Webserver multiple DoS vulnerabilities. Author: 0in Maksymilian Motyl Date: 18.02.2014 Version: 3.1.3-0 Software Link: http://embedthis.com/products/goahead/ Download: https://github.com/embedthis/goahead Tested on: Linux x32 Description: "GoAhead is embedded in hundreds ...

Trendchip HG520 ADSL2+ Wireless Modem - Cross-Site Request Forgery

Exploit Title: Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability Google Dork: N/A Date: 15/02/2014 Exploit Author: Dhruv Shah Vendor Homepage: N/A Software Link : N/A Version: Firmware Version:2.11.38.0RE0.C2B3.9.9.5 Tested on: Embedded Allegro RomPager webserver 4.07 UPnP/1.0 ZyXEL ZyWALL...

List of 8,000 FTP Credentials for Sale in Underground Forums

Hackers are targeting FTP upload sites with the hopes of redirecting victims to spam or even infecting webservers that rely on FTP applications for updates. Hold Security reported yesterday it had secured a list of credentials for close to 7,800 FTP sites being circulated in cybercrime forums. Th...

Osclass - Multiple Input Validation Vulnerabilities

Osclass - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/64386/info Osclass is prone to the following input-validation vulnerabilities: 1. A cross-site request-forgery vulnerability 2. Multiple directory-traversal vulnerabilities 3. An SQL-injection...

Osclass - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/64386/info Osclass is prone to the following input-validation vulnerabilities: 1. A cross-site request-forgery vulnerability 2. Multiple directory-traversal vulnerabilities 3. An SQL-injection vulnerability Exploiting these issues may allow a remote...

IT-Grundschutz M4.094: Schutz der Webserver-Dateien

IT-Grundschutz M4.094: Schutz der Webserver-Dateien. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94210 Stand: 13. Ergänzungslieferung 13. EL. OpenVAS Vulnerability...

IT-Grundschutz M4.094: Schutz der Webserver-Dateien

IT-Grundschutz M4.094: Schutz der Webserver-Dateien. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94210 Stand: 13. Ergänzungslieferung 13. EL. Copyright C 2013...

JBoss AS Attacks Up Since Exploit Code Disclosed

Attackers are exploiting a two-year-old vulnerability in JBoss Application Servers that enables a hacker to remotely get a shell on a vulnerable webserver. The number of infections has surged since exploit code called pwn.jsp was publicly disclosed Oct. 4. Researchers at Imperva said that a numbe...

JunOS 11.4 Cross Site Scripting

Vulnerability Type: XSS Cross-Site Scripting - Original release date: November 11th, 2013 - Last revised: November 11th, 2013 - Discovered by: Andrea Bodei - A2SECURE - Severity: 4.3/10 CVSSv2 Base Scored Products and affected versions: JUNOS up to 11.4 probably 12.1 and 12.3 vulnerable...

Debian DSA-2783-1 : librack-ruby - several vulnerabilities

Several vulnerabilities were discovered in Rack, a modular Ruby webserver interface. The Common Vulnerabilites and Exposures project identifies the following vulnerabilities : - CVE-2011-5036 Rack computes hash values for form parameters without restricting the ability to trigger hash collisions...

DSA-2783-1 librack-ruby - several

Bulletin has no description...

Debian Security Advisory DSA 2783-1 (librack-ruby - several vulnerabilities)

Several vulnerabilities were discovered in Rack, a modular Ruby webserver interface. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2011-5036 Rack computes hash values for form parameters without restricting the ability to trigger hash collisions...

Fedora 20 : roundcubemail-0.9.4-1.fc20 (2013-16162)

0.9.4, latest upstream. Require webserver rather than httpd. Two XSS flaws were fixed in roundcube 0.9.3 1 : - Fix XSS vulnerability when saving HTML signatures 2,3 - Fix XSS vulnerability when editing a message 'as new' or draft 2,4 1 http://trac.roundcube.net/wiki/ChangelogRELEASE0.9.3 2...

Fedora 18 : roundcubemail-0.9.4-1.fc18 (2013-16192)

0.9.4, latest upstream. Require webserver rather than httpd. Two XSS flaws were fixed in roundcube 0.9.3 1 : - Fix XSS vulnerability when saving HTML signatures 2,3 - Fix XSS vulnerability when editing a message 'as new' or draft 2,4 1 http://trac.roundcube.net/wiki/ChangelogRELEASE0.9.3 2...

WordPress Plugin Complete Gallery Manager 3.3.3 - Arbitrary File Upload Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

Debian Security Advisory DSA 2532-1 (libapache2-mod-rpaf - denial of service)

Sebastien Bocahu discovered that the reverse proxy add forward module for the Apache webserver is vulnerable to a denial of service attack through a single crafted request with many headers. OpenVAS Vulnerability Test $Id: deb25321.nasl 14276 2019-03-18 14:43:56Z cfischer $ Auto-generated from...

Debian: Security Advisory (DSA-2532-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

$_GET not cleaned when parsed from REQUEST_URI

When none of the default methods of determining the request URI have succeeded, the framework will fallback to parsing the raw request URI as passed by the webserver. If this URI has a query string, it will be parsed and $GET will be updated. In this process, the $GET variables are not cleaned,...

PWStore 2010.8.30.0 Cross Site Scripting / Denial Of Service

PWStore version 2010.8.30.0 suffers from cross site scripting and denial of service vulnerabilities. - RealPentesting Advisory - Title: MULTIPLE VULNERABILITIES IN PWSTORE 2010.8.30.0 Severity: Medium History: 16.Apr.2013 Vulnerability reported Authors: Josep Pi Rodriguez, Pedro Guillen Nuñez,...

AdvancePro Technologies Advanceware software suite vulnerable to privilege bypass

Overview AdvancePro Technologies Advanceware software suite contains a privilege bypass vulnerability, resulting in information leakage CWE-200. Description CWE-200: Information Exposure AdvancePro Technologies Advanceware software suite contains a privilege bypass vulnerability, resulting in...