5528 matches found
Cisco Content Security Management Appliance Web UI Default Credentials
It is possible to log into Cisco Content Security Management Appliance's web management console using default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid73301; scriptversion"1.5";...
Cisco AsyncOS for Content Security Management Appliances Software Remote Code Execution (CSCug80118)
According to its self-reported version, the version of Cisco Content Security Management Appliance running on the remote host is affected by a remote code execution vulnerability due to a flaw in Cisco AsyncOS. An authenticated attacker could potentially exploit this vulnerability to execute...
Cisco Patches AsyncOS Code Execution Vulnerability
Cisco fixed serious vulnerabilities this week in its email and content security management products that could have let an attacker execute code with the privileges of the root user. The company pushed a fix for its AsyncOS Software in both its Email Security Appliance ESA and the Content Securit...
CVE-2014-2119
The End User Safelist/Blocklist aka SLBL service in Cisco AsyncOS Software for Email Security Appliance ESA before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance SMA before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrar...
Code injection
The End User Safelist/Blocklist aka SLBL service in Cisco AsyncOS Software for Email Security Appliance ESA before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance SMA before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrar...
CVE-2014-2119
The CVE-2014-2119 issue affects Cisco AsyncOS for Email Security Appliance (ESA) and Content Security Management Appliance (SMA). The End User Safelist/Blocklist (SLBL) service permits an authenticated remote user to execute arbitrary code with root privileges by uploading a modified SLBL databas...
CVE-2014-2119
The End User Safelist/Blocklist aka SLBL service in Cisco AsyncOS Software for Email Security Appliance ESA before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance SMA before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrar...
Cisco AsyncOS Software Code Execution Vulnerability
Cisco AsyncOS Software for Email Security Appliance ESA and Cisco Content Security Management Appliance SMA contain a vulnerability that could allow an authenticated remote attacker to execute arbitrary code with the privileges of the root user. Cisco has released software updates that address th...
CVE-2014-1504
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted document that is accessed after a browser restart...
Cross site scripting
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted document that is accessed after a browser restart...
CVE-2014-1504
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via a crafted document that is accessed after a browser restart...
CVE-2014-1504
CVE-2014-1504 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The session-restore feature does not honor the CSP of data: URLs, enabling remote XSS via a crafted document opened after a browser restart. The impact stated is cross-site scripting with partial integrity/complete confide...
mozilla -- multiple vulnerabilities
The Mozilla Project reports: MFSA 2014-15 Miscellaneous memory safety hazards rv:28.0 / rv:24.4 MFSA 2014-16 Files extracted during updates are not always read only MFSA 2014-17 Out of bounds read during WAV file decoding MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key MFSA...
Content Security Policy for data: documents not preserved by session restore — Mozilla
Security researcher Nicolas Golubovic reported that the Content Security Policy CSP of data: documents was not saved as part of session restore. If an attacker convinced a victim to open a document from a data: URL injected onto a page, this can lead to a Cross-Site Scripting XSS attack. The targ...
HackerOne: javascript: and mailto: links are allowed on users' profiles
For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...
CVE-2014-1485
The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...
CVE-2014-1485
CVE-2014-1485 affects Mozilla Firefox (prior to 27.0) and SeaMonkey (prior to 2.24). The CSP implementation in these browsers evaluates style-src directives for XSLT processing rather than script-src, potentially allowing remote attackers to execute arbitrary XSLT code through insufficient style-...
CVE-2014-1485
The Content Security Policy CSP implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient...