Gentoo Security Advisory GLSA 201506-03

Gentoo Linux Local Security Checks GLSA 201506-03 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Gentoo Security Advisory GLSA 201402-09

Gentoo Linux Local Security Checks GLSA 201402-09 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Design/Logic Flaw

The REST API in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors...

IBM WebSphere MQ 'PCF Response Message Handling' DoS Vulnerability (Jun 2015)

IBM WebSphere MQ is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-2278

CVE-2015-2278 and CVE-2015-2282 affect SAP products via the LZH/LZC decompression paths. The root causes are in the LZH BuildHufTree function (vpa108csulzh.cpp) and the LZC decompression logic (vpa106cslzc.cpp), where attacker-controlled indices can trigger out-of-bounds reads/writes. Affected so...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Business Process Manager BPM 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition WLE 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL th...

CVE-2015-0189

The CVE-2015-0189 entry affects IBM WebSphere MQ: cluster repository manager in MQ versions 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated admins to cause a denial of service via triggering multiple transmit-queue records, causing memory overwrite and daemon outage. Documen...

Symantec Workspace Streaming Agent Privilege Escalation Vulnerability

Symantec Workspace Streaming Agent is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

Elastic Elasticsearch < 1.3.8, 1.4.x < 1.4.3 Groovy Scripting Engine Unauthenticated RCE Vulnerability - Active Check

Elastic Elasticsearch is prone to an unauthenticated remote code execution RCE. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PHPWind 7.5 /apps/groups/index.php 远程文件包含漏洞

No description provided by source...

WordPress Photo Gallery Blind SQL injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

IBM WebSphere Service Registry and Repository 7.5 < 7.5.0.4 Multiple Vulnerabilities

The version of IBM WebSphere Service Registry and Repository WSRR is version 7.5 prior to 7.5.0.4. It is therefore, affected by multiple vulnerabilities : - An unspecified DOM based cross-site scripting XSS vulnerability in the WSRR web UI. CVE-2014-6132 - WSSR web interface issues a cookie that ...

Oracle Solaris Third-Party Patch Update : samba (cve_2012_1182_arbitrary_code)

The remote Solaris system is missing necessary patches to address security updates : - The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation,...

某管理系统通用型SQL注入

简要描述： 某管理系统通用型SQL注入 详细说明： 厂商：南京苏亚星资讯科技开发有限公司 资源库管理系统 搜索引擎关键字：帮助 正在读取数据... 注册用户 系统用户 用户名: 密码: 南京苏亚星资讯科技开发 有一部分是内网使用，好不容易找到5个案例。...

Microsoft IIS 7.5 Cross Site Scripting

Hello everyone, I found some weird HTML code injection in an IIS error message. IIS spits out some part of the user input that generated the error message, but will only display 20 characters at most. My question is: is it possible to actually exploit an XSS with this ? Here is an example: HTTP...

VMTurbo Operations Manager '/cgi-bin/vmtadmin.cgi' RCE Vulnerability

VMTurbo Operations Manager is prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Xxe

callService.do in IBM Business Process Manager BPM 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...

Fedora Update for chicken FEDORA-2014-6553

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-3025

Multiple cross-site scripting XSS vulnerabilities in IBM Maximo Asset Management 6.2 through 6.2.8, 6.x and 7.1 through 7.1.1.2, and 7.5 through 7.5.0.6; Maximo Asset Management 7.5 through 7.5.0.3 and 7.5.1 through 7.5.1.2 for SmartCloud Control Desk; and Maximo Asset Management 6.2 through 6.2....

CVE-2014-0957

IBM WebSphere Lombardi Edition and IBM Business Process Manager are affected by a cross-site scripting (XSS) flaw due to improper validation of user-supplied input. A remote attacker can exploit this via a crafted URL to trigger an unhandled service failure and potentially access cookie-based cre...