CVE-2015-5475

CVE-2015-5475 affects Request Tracker (RT) 4.x up to 4.2.12. It exploits cross-site scripting via the user and group rights management pages, enabling remote attackers to inject arbitrary web script/HTML. The vulnerability is documented in multiple sources (NVD, Mageia/other advisories). The stat...

CVE-2015-1840

CVE-2015-1840 describes a CSRF/XSS-style risk in Rails tooling: jquery_ujs.js and rails.js could cause a CSRF token to be transmitted to a different-domain server when a URL attribute contains a leading space. This bypasses the Same Origin Policy under supported Rails setups (Rails 3.x/4.x with j...

CVE-2015-0130

Cross-site scripting XSS vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager RQM 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert RTC 4.x before 4.0....

Cross site scripting

Cross-site scripting XSS vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4093

Elasticsearch Kibana 4.x prior to 4.0.3 is vulnerable to cross-site scripting (XSS). The vulnerability is described as allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected product is Kibana 4.x; the issue stems from an XSS flaw in versions before 4.0....

Samba 4.x < 4.0.24 / 4.1.x < 4.1.16 / 4.2.x < 4.2rc4 UF_SERVER_TRUST_ACCOUNT AD DC Privilege Escalation

Binary data 8758.prm...

Samba 4.x < 4.0.21 / 4.1.x < 4.1.11 nmbd Remote Code Execution

Binary data 8759.prm...

Samba 4.x Detection

Binary data 8741.prm...

CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

Design/Logic Flaw

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service synchronization loss by spoofing the...

CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

CVE-2015-1799

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service synchronization loss by spoofing the...

CVE-2015-1798

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC...

CVE-2015-1799

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service synchronization loss by spoofing the...

Cross site request forgery (csrf)

libraries/selectlang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to...

Apache Tomcat Version 4.x Detection

Binary data 8925.prm...

Viber 5 Exploit on android 4.x (reset the phone to factory settings) 0day

You are sending a specially crafted message that leads to reboot the phone and reset functions of the phone to factory settings. After rebooting, the phone does not have personal data. This vulnerability will only work on Android OS. If you want to buy good 0day exploit on one hands...

Oracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird2)

The remote Solaris system is missing necessary patches to address security updates : - Cross-site scripting XSS vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via...

CVE-2014-8143

Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller AD DC is configured, allows remote authenticated users to set the LDB userAccountControl UFSERVERTRUSTACCOUNT bit, and consequently gain privileges, by leveraging delegation of...

Design/Logic Flaw

Samba 4.0.x before 4.0.24, 4.1.x before 4.1.16, and 4.2.x before 4.2rc4, when an Active Directory Domain Controller AD DC is configured, allows remote authenticated users to set the LDB userAccountControl UFSERVERTRUSTACCOUNT bit, and consequently gain privileges, by leveraging delegation of...