Cisco Prime Network Registrar Information Disclosure Vulnerability

Cisco Prime Network Registrar CPNR is a network registrar product from the U.S. company Cisco Cisco. The product provides services such as Dynamic Host Configuration Protocol DHCP, Domain Name System DNS and IP Address Management IPAM. A security vulnerability exists in the System Configuration...

Code injection

Cisco Access Point devices with software 8.2102.43 allow remote attackers to cause a denial of service device reload via crafted ARP packets, aka Bug ID CSCuy55803...

CVE-2016-1419

CVE-2016-1419 affects Cisco Aironet access points running 8.2(102.43). The issue stems from improper processing of ARP packets, allowing an unauthenticated adjacent attacker to send crafted ARP requests and cause a denial of service (device reload) on Cisco Aironet 1800/2800/3800 series platforms...

CVE-2016-4792

The CVE-2016-4792 issue affects Pulse Connect Secure (PCS) versions 8.2 and earlier up to 8.2r1. The vulnerability allows remote disclosure of sign-in pages via unspecified vectors and does not indicate exploitation details in the provided documents. Affected components are the PCS sign-in/pages ...

PT-2016-6140 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure PCS versions 7.4 through 7.4r13.3 Pulse Connect Secure PCS versions 8.0 through 8.0r10 Pulse Connect Secure PCS versions 8.1 through 8.1r2 Pulse Connect Secure PCS versions 8.2 through 8.2r0 Description: The issue allows...

GE Proficy HMI SCADA CIMPLICITY Privilege Management Vulnerability

OVERVIEW Zhou Yu of Acorn Network Security identified an improper privilege management vulnerability and recently released exploit code for the GE Proficy HMI/SCADA CIMPLICITY application without coordination with ICS-CERT, the vendor, or any other coordinating entity known to ICS-CERT. GE produc...

Authentication flaw

Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx...

Cisco ASA VPN ISAKMP DoS Vulnerability (cisco-sa-20151021-asa-ike)

A vulnerability in the IKE code of Cisco ASA may lead to a denial of service. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...

Cisco ASA Multiple OpenSSL Vulnerabilities (cisco-sa-20150612-openssl)

Cisco ASA is prone to multiple vulnerabilities in the OpenSSL library. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Audacious 3.7 - ID3 Local Crash (PoC)

Audacious 3.7 - ID3 Local Crash PoC Exploit Title: Audacious 3.7 ID3 Local Crash PoC Date: 11-20-2015 Exploit Author: Antonio Z. Vendor Homepage: http://audacious-media-player.org/ Software Link: http://audacious-media-player.org/download |...

Switch v4.68 - Code Execution Vulnerability

Document Title: =============== Switch v4.68 - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1649 Release Date: ============= 2015-11-23 Vulnerability Laboratory ID VL-ID: ==================================== 1649 Common...

Murgent CMS - SQL Injection Vulnerability

Document Title: =============== Murgent CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1646 Release Date: ============= 2015-11-16 Vulnerability Laboratory ID VL-ID: ==================================== 1646 Common...

Murgent CMS - SQL Injection Vulnerability

Document Title: =============== Murgent CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1646 Release Date: ============= 2015-11-16 Vulnerability Laboratory ID VL-ID: ==================================== 1646 Common...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a 1 parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the 2 CMSBodyClass cookie variable to the default URI...

Open redirect

Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter...

Kentico CMS 8.2 Cross Site Scripting / Open Redirect

Web application Kentico CMS 8.2 XSS / Open Redirection The CVE-2015-7823 reference is still waiting my disclosure. The exploit works on 8.2 to 8.2.41 I've contacted the vendor and he fixed the vulnerability in the next major version Vulnerability type: Reflected XSS High The elementguid variable ...

Damn Vulnerable iOS App: DVIA

Damn Vulnerable iOS App DVIA is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills in a legal environment. This application covers all the common vulnerabilities...

NetCracker Resource Management System 8.0 SQL Injection

Vulnerability type: SQL Injection Vendor: http://www.netcracker.com/ Product: NetCracker Resource Management System Affected version: = 8.0 Patched version: 8.2 Credit: Foo Jong Meng, Chia Junyuan, Benjamin Tan CVE ID: CVE-2015-3423 PROOF OF CONCEPT SQLi SQL Injection SQLi vulnerability in multip...

Cross site request forgery (csrf)

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request...

CVE-2015-0131

Cross-site scripting XSS vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...