CVE-2016-1598

XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-4029

WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-6635

CVE-2016-6635 affects WordPress core: the CSRF flaw is in wp_ajax_wp_compression_test (wp-admin/includes/ajax-actions.php) in WordPress before 4.5, enabling remote attackers to hijack administrator sessions and change the script compression option. Affected: WordPress prior to 4.5. Impact: admin-...

PT-2016-5814 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 4.5 Description: The issue allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address, as WordPress does not consider octal and hexadecimal IP address formats when determining an...

Design/Logic Flaw

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

Neoscreen 4.5 Blind SQL Injection

Exploit Title: Neoscreen Blind SQL injection Product: Neoscreen by Cube Digital Media Vulnerable Versions: 4.5 and all previous versions Tested Version: 4.5 Advisory Publication: July 24, 2016 Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2016-1404

CVE-2016-1404 affects Cisco UCS Invicta software, including Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System. The root cause is a single hardcoded GnuPG encryption key used across different customer installations, enabling remote attackers to defeat cryptographic prote...

Micro Focus Rumba+ 9.4 - Multiple Stack Buffer Overflow Vulnerabilities

Micro Focus Rumba+ 9.4 - Multiple Stack Buffer Overflow Vulnerabilities Micro Focus Rumba+ v9.4 Multiple Stack Buffer Overflow Vulnerabilities Vendor: Micro Focus Product web page: https://www.microfocus.com Affected version: 9.4.4058.0 and 9.4.0 SP0 Patch0 Affected products/tools : Rumba Desktop...

Google Authenticator <= 0.47 - Two Factor Authentication Bypass

WordPress 4.5 introduced the ability to login with an email address instead of a username. Google Authenticator v0.47 wasn't aware of the new feature, and didn't properly handle the case where an email address was used instead of a username. Using an email address would allow an attacker with a...

CVE-2015-8812

drivers/infiniband/hw/cxgb3/iwchcm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free via crafted packets...

神器而已之EMobile某版本表达式注入（命令执行）

简要描述： 神器扫出来的 详细说明： 版本：E-Mobile 4.5 查看源码即可看到 .../verifyLogin.do data：loginid=CasterJs&password=CasterJs&clienttype=Webclient&clientver=4.5&language=&country=&[email protected]@[email protected]@getRuntime.exec'ipconfig'.getInputStream 其他案例 http://.../verifyLogin.do data:...

WordPress <= 4.4.1 - XSS

WordPress before 4.4.1 is prone to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary script or HTML in the network settings page. Solution Update WordPress to 4.5...

atl2 driver memory leak vulnerability

The atl2 driver is a set of Linux kernel drivers for Ethernet adapters. scatter/gather IO is a standard technique used for high-performance IO. netiffsg is an identifier used to determine whether scatter/gather I/O is enabled. A security vulnerability exists in the atl2 driver versions 3.8 throug...

CVE-2016-2560

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Host HTTP header, related to libraries/Config.class.php; 2 crafted JSON data, relat...

CVE-2016-2042

phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2 libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message...

CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

DEBIAN-CVE-2016-2038

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2045

Cross-site scripting XSS vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response...