CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

CVE-2014-4383: Improper Input Validation

The Assets subsystem in Apple iOS before 8 and Apple TV before 7 allows man-in-the-middle attackers to spoof a device's update status via a crafted Last-Modified HTTP response header...

ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution

Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Background on the affected product: "Deskt...

ESA-2014-059: EMC Documentum Multiple Cross-Site Scripting Vulnerabilities

ESA-2014-059.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-059: EMC Documentum Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2014-059 CVE Identifier: CVE-2014-2511 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • EMC WebTop...

imacs CMS 0.3.0 - Unrestricted File Upload Exploit

No description provided by source. ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : imacs CMS...

Vulnerability Management: Think Like an Attacker to Prioritize Risks

Attackers care about ROI – they want to accomplish their objective with the least investment of time and resources possible. The same is true for you - to most effectively manage vulnerabilities, you need to think like an attacker. Ask yourself: How would you go about compromising systems,...

CVE-2011-4958

Cross-site scripting XSS vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING to template placeholders, as demonstrated by a request to 1 admin/reports/, 2...

Cross site scripting

Cross-site scripting XSS vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING to template placeholders, as demonstrated by a request to 1 admin/reports/, 2...

PT-2013-6283

Name of the Vulnerable Software and Affected Versions ThemeBeans Blooog theme version 1.1 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the jQuery parameter to the "assets/js/jplayer.swf" endpoint. Recommendations For...

CVE-2013-7129: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ThemeBeans Blooog theme 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the jQuery parameter to assets/js/jplayer.swf...

Critical Infrastructure Beyond the Power Grid

The term "critical infrastructure" has earned its spot on the board of our ongoing game of cyber bingo--right next to "Digital Pearl Harbor," "Cyber 9/11," "SCADA" and "Stuxnet." With "critical infrastructure" thrown about in references to cyber threats nearly every week, we thought it was time f...

Politics, Uncertainty Slowing Down U.S. Response to Cyber Threats

WASHINGTON–The shift in the last few years to cyberespionage and online attacks against the nation’s critical infrastructure have left the United States government lagging behind, and “a day late and a dollar short”, the former director of the National Security Agency said. The ongoing campaigns...

CVE-2013-1464: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter...

CVE-2012-4983

The CVE-2012-4983 issue affects Forescout CounterACT/NAC devices, with XSS vulnerabilities on the login page via the a parameter and on the rangesearch query, allowing arbitrary script injection. It applies to versions prior to 7.0 (notably seen in 6.3.4.1). Impact includes potential redirection ...

PT-2012-5702

Name of the Vulnerable Software and Affected Versions Forescout CounterACT NAC device versions prior to 7.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter in the assets/login endpoint. Recommendation...

CVE-2012-4982: Improper Input Validation

Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter...

CVE-2012-4983: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via 1 the a parameter to assets/login or 2 the query parameter to assets/rangesearch...

PT-2012-5703

Name of the Vulnerable Software and Affected Versions Forescout CounterACT NAC device versions prior to 7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the...

Adobe Bridge Installed

Adobe Bridge is installed on the remote Windows host. Bridge is used to organize creative assets, and provide centralized access for applications in the Adobe Creative Suite. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62681; scriptversion"1.13";...

Think Like a Hacker for Better Security

Computer hacking is truly an epidemic. It's not enough to apply the latest patches to your servers and workstations or otherwise defend yourself reactively. If you're in charge of your network's security, you must understand how hackers minds work and what tools they're using for their attacks...