CVE-2014-6302

PNMsoft Sequence Kinetics prior to version 7.7 is affected by an XML External Entity (XXE) vulnerability in the Monitoring Administration pages, allowing remote attackers to read arbitrary files via XML external entity declarations combined with entity references. The root cause is XXE processing...

CVE-2014-6303

Technical details about CVE-2014-6303 (affected product, version specifics, root cause, impact, or fixes) are not provided in the supplied Connected documents. Monitor for updates in official advisories for precise remediation information.

CVE-2014-6302

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6303

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service resource consumption via a crafted XML document containing a large number of nested entity references, a...

4images Cross Site Scripting / Clickjacking

Affected software: 4images Type of vulnerability: clickjacking,xss URL: http://www.4homepages.de/ Discovered by: Provensec Website: http://www.provensec.com Description: 4images is a powerful web-based image gallery management system. Features include comment system, user registration and...

ovirt-engine-webadmin: does not invalidate all sessions upon logout

It was found that oVirt did not correctly terminate sessions when a user logged out from the web interface. Upon logout, only the engine session was invalidated but the restapi session persisted. An attacker able to obtain the session data, and able to log in with their own credentials, could...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8110

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8110

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8110

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8110

Apache ActiveMQ (5.x) prior to 5.10.1 is affected by cross-site scripting in the web-based admin console (CVE-2014-8110). Attacks could inject script/HTML via unspecified vectors and, per related IBM advisories, could lead to credential theft via cookies. Remote exploitation is possible if expose...

Linux Kernel 'nft_flush_table' function local denial of service vulnerability

Linux is an open source computer operating system kernel. A local denial of service vulnerability exists in the Linux Kernel 'nftflushtable' function, which can be exploited by a local attacker with CAPNETADMIN to launch a denial of service attack...

Fortinet FortiWeb CSRF Vulnerability (FG-IR-14-013)

Fortinet FortiWeb is prone to multiple cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1444

Multiple cross-site scripting XSS vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the 1 conntrack.cgi, 2 index.cgi, 3 logsyslog.cgi, 4 problems.cgi, 5...

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

Facebook Album Fetcher module allows you to fetch Facebook albums from a Facebook account. The module incorrectly prints fields without proper sanitization thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

WordPress Video Player <= 1.5.4 - Reflected Cross-Site Scripting (XSS)

The 'Tags' section of 'WordPress Video Player' under WordPress Administration contains a two fields that are vulnerable to a reflected XSS attack. This is due to the fact that the value passed through to these fields are not encoded prior to output. There is also no nonce on this page, which mean...

b2evolution 'filemanager' cross-site scripting vulnerability

b2evolution is a PHP and MySQL based blogging software developed by software developer Francois Planque. A cross-site scripting vulnerability exists in b2evolution 'filemanager'. The blogs/admin.php script fails to adequately filter the 'fmfilter' parameter. A remote attacker can exploit the...

ManageEngine Password Manager Pro Default Credentials

The remote ManageEngine Password Manager Pro web administration interface uses a known set of default credentials. An attacker can use these to gain access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

SA-CONTRIB-2015-023 - Classified Ads - Cross Site Scripting (XSS)

Classified Ads module enables administrators to create classified ads in various categories. The module doesn't correctly escape the category names in its administration user interface. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer...

Pirelli Home Broadband Routers Exposed for Two Years

ISP-issued home broadband routers have been a shooting gallery for researchers and hackers alike looking for, and successfully exploiting, shocking vulnerabilities. One disclosed by a researcher in Spain this week is symptomatic of the problem to a disturbing degree. Researcher Eduardo Novella...