Design/Logic Flaw

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

CVE-2015-1110: Exposure of Sensitive Information to an Unauthorized Actor

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

PT-2015-5094

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.3 Apple TV versions prior to 7.2 Description The issue allows remote attackers to discover unique identifiers by reading asset-download request data. This is related to the Podcasts component. Recommendations For...

FREAK Attack: How to Protect Yourself

The recently disclosed FREAK Factoring attack on RSA Export Keys attack is an SSL/TLS vulnerability that is affecting major browsers, servers and even mobile devices. FREAK vulnerability allows the attacker to intercept HTTPS connections between vulnerable clients and servers and force them to us...

Scientific Linux Security Update : virt-who on SL7.x (noarch) (20150305)

It was discovered that the /etc/sysconfig/virt-who configuration file, which may contain hypervisor authentication credentials, was world- readable. A local user could use this flaw to obtain authentication credentials from this file. CVE-2014-0189 The virt-who package has been upgraded to upstre...

RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-162-01 RLE Nova‑Wind Turbine HMI Unsecure Credentials Vulnerability that was published June 11, 2015, on the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified an unsecure credential...

Network Time Protocol Vulnerabilities (Supplement)

OVERVIEW This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01 Network Time Protocol Vulnerabilities that was published December 19, 2014, on the ICS‑CERT web site. Please refer to the original advisory for all the details of the vulnerabilities. The purpose o...

Dell ScriptLogic Asset Manager SQL Injection remote code execution (CVE-2015-1605)

A remote code execution vulnerability has been reported in Dell ScriptLogic Asset Manager. The vulnerability is due to insufficient input validation while processing requests to GetProcessedPackage.aspx or GetClientPackage.aspx, this enables attacker to inject SQL code. A remote attacker can...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2015-01431)

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM Maximo Asset Management that could allow a remote, authenticated user to inject arbitrary web script or HTML via unspecified vectors...

IBM Maximo Asset Management Catalog Traversal Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. A directory traversal vulnerability exists in IBM Maximo Asset Management that could allow an authenticated remote user to read arbitrary files via a pathname...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. A cross-site scripting vulnerability exists in IBM Maximo Asset Management that allows a remote, authenticated user to inject arbitrary web script or HTML via unspecified vector 7...

IBM Maximo Asset Management Access Restriction Bypass Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. An access restriction bypass vulnerability exists in IBM Maximo Asset Management, which allows an attacker to directly integrate access restrictions through the expected Cognos BI by leveraging an unattended...

CVE-2015-1605

Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager aka Quest Workspace Asset Manager before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to 1 GetClientPackage.aspx or 2 GetProcessedPackage.aspx...

Sql injection

Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager aka Quest Workspace Asset Manager before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to 1 GetClientPackage.aspx or 2 GetProcessedPackage.aspx...

CVE-2015-1605

Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager aka Quest Workspace Asset Manager before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to 1 GetClientPackage.aspx or 2 GetProcessedPackage.aspx...

CVE-2015-1605

Dell ScriptLogic Asset Manager (Quest Workspace Asset Manager) vulnerable before 9.5 due to multiple SQL injection flaws in GetClientPackage.aspx and GetProcessedPackage.aspx. Root cause: insufficient input validation allowing remote SQL injection, enabling remote code execution under the NETWORK...

CVE-2015-1605: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager aka Quest Workspace Asset Manager before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to 1 GetClientPackage.aspx or 2 GetProcessedPackage.aspx...

Multiple SQL Injection Vulnerabilities in Dell Asset Manager

Dell Asset Manager is an asset management software. Dell Asset Manager GetClientPackage.aspx and GetProcessedPackage.aspx fail to properly handle WEB requests, allowing remote attackers to exploit vulnerabilities by submitting specially crafted SQL queries to manipulate or obtain database data...

Dell ScriptLogic Asset Manager GetProcessedPackage SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell ScriptLogic Asset Manager, also known as Quest Workspace Asset Manager. Authentication is not required to exploit this vulnerability. To exploit this security flaw, an attacker would make a...

PT-2015-5385

Name of the Vulnerable Software and Affected Versions Dell ScriptLogic Asset Manager versions prior to 9.5 Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This is achieved through unspecified vectors to API endpoints such...