CVE-2013-3384

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management...

CVE-2013-3386

The IronPort Spam Quarantine ISQ component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019 and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers...

CVE-2013-3385

The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019; and Content Security Management Appliance...

CVE-2013-3386: Undefined Security Weakness

The IronPort Spam Quarantine ISQ component in the web framework in IronPort AsyncOS on Cisco Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019 and Content Security Management Appliance devices before 7.9.1-102 and 8.0 before 8.0.0-404 allows remote attackers...

CVE-2013-3385: Undefined Security Weakness

The management GUI in the web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-602; Email Security Appliance devices before 7.1.5-106 and 7.3, 7.5, and 7.6 before 7.6.3-019; and Content Security Management Appliance...

CVE-2013-3384: Improper Control of Generation of Code

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance SMA devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749...

CVE-2013-3396

Cross-site scripting XSS vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance SMA devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749...

CVE-2013-3396

CVE-2013-3396 is a reflected XSS vulnerability in Cisco Content Security Management Appliance (SMA) web framework. OpenVAS notes Cisco IronPort SMA XSS/CSRF issues, with CVE-2013-3396 listed and the OpenVAS payload pointing to a lack of output escaping in the default error 500 page, causing refle...

Multiple Vulnerabilities in Cisco Content Security Management Appliance

Cisco IronPort AsyncOS Software for Cisco Content Security Management Appliance is affected by the following vulnerabilities: Web Framework Authenticated Command Injection Vulnerability IronPort Spam Quarantine Denial of Service Vulnerability Management GUI Denial of Service Vulnerability These...

CVE-2013-3396: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web framework in Cisco Content Security Management on Security Management Appliance SMA devices allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuh24749...

CSP 1.0 Added to Firefox to Block XSS Attacks

After years of discussion and waiting, Mozilla has finally added Content Security Policy 1.0, a defense against some common attacks such as XSS, to its Firefox browser. CSP already has been implemented in Google Chrome and Internet Explorer and there was a limited implementation of it in Firefox...

Multiple XSS - ownCloud

Due to not sanitising all user provided input the below mentioned ownCloud versions are vulnerable against several XSS attack vectors. ownCloud advises browsers to disable inline JavaScript execution due to the used Content-Security-Policy, this vulnerability is therefore likely not exploitable i...

UI Redressing (Clickjacking)

Confluence is vulnerable to Clickjacking|https://en.wikipedia.org/wiki/Clickjacking. That is, it is possible to frame confluence from a page hosted in a different domain and trick the user into performing an action they did not intend to perform, for example changing their display name. This issu...

Chrome 25 to Support Unprefixed Content Security Policy

Google is continuing to introduce new security technologies in its Chrome browser, and the latest addition on the horizon is support for unprefixed Content Security Policy, a behind-the-scenes improvement designed to prevent malicious script injections. The technology is included in the beta of...

SuSE Update for MozillaThunderbird openSUSE-SU-2012:0917-1 (MozillaThunderbird)

Check for the Version of MozillaThunderbird OpenVAS Vulnerability Test $Id: gbsuse201209171.nasl 8273 2018-01-03 06:29:19Z teissa $ SuSE Update for MozillaThunderbird openSUSE-SU-2012:0917-1 MozillaThunderbird Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...

SuSE Update for seamonkey openSUSE-SU-2012:0935-1 (seamonkey)

Check for the Version of seamonkey OpenVAS Vulnerability Test $Id: gbsuse201209351.nasl 8249 2017-12-27 06:29:56Z teissa $ SuSE Update for seamonkey openSUSE-SU-2012:0935-1 seamonkey Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

FreeBSD : mozilla -- multiple vulnerabilities (dbf338d0-dce5-11e1-b655-14dae9ebcf89)

The Mozilla Project reports : MFSA 2012-42 Miscellaneous memory safety hazards rv:14.0/ rv:10.0.6 MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop MFSA 2012-44 Gecko memory corruption MFSA 2012-45 Spoofing issue with location MFSA 2012-46 XSS through data: URLs MFSA 2012-4...

Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120717)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. CVE-2012-1948,...

Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120314)

Mozilla Firefox is an open source web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-0461,...