Hardcoded credentials

The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and consequently obtain sensitive information, via a crafted URL...

CVE-2015-5820

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted 1 tel://, 2 facetime://, or 3 facetime-audio:// URL...

CVE-2015-5820

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted 1 tel://, 2 facetime://, or 3 facetime-audio:// URL...

CVE-2015-5820

CVE-2015-5820 affects WebKit in Apple iOS prior to iOS 9. A crafted tel://, facetime://, or facetime-audio:// URL can trigger a dialing action, enabling remote dialing via web content. The documentation specifies the vulnerability arises from WebKit/URL handling; exploits or in‑the‑wild details a...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...

PT-2015-7481

Name of the Vulnerable Software and Affected Versions Commerce Commonwealth CBA module versions 7.x-1.x through 7.x-1.4 Description The issue is related to improper validation of payments, allowing remote attackers to make a failed payment appear valid by using a crafted URL. This is related to a...

Symantec Web Gateway Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the path processing for command URLs accessed through the management port of the...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to inject arbitrary web or HTML code.

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code using a specially crafted...

CVE-2015-6465

The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service reboot via a crafted URL...

Code injection

The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service reboot via a crafted URL...

CVE-2015-6465: Undefined Security Weakness

The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service reboot via a crafted URL...

Microsoft Lync Server Cross-Site Scripting Vulnerability (CNVD-2015-05942)

Microsoft Lync is the next generation of integrated enterprise communication platform. Microsoft Lync Server 2013 and Skype for Business Server 2015, a cross-site scripting vulnerability exists in the jQuery engine, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2015-2532

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

CVE-2015-2532: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

PT-2015-2003

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server 2013 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a crafted URL. This is due to the lack of protection measures for t...

PT-2015-2000

Name of the Vulnerable Software and Affected Versions Microsoft Lync Server version 2013 Skype for Business Server version 2015 Description The issue is related to a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via a crafted URL. This ...

CVE-2015-2536: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."...

Invision Power Services IPS Community Suite Resource Management Error Vulnerability

Invision Power Services IPS Community Suite a.k.a. Invision Power Board, IPB or Power Board is a PHP and MySQL based Web forum program from Invision Power Services, Inc. A security vulnerability exists in Invision Power Services IPS Community Suite 4.0.11 and earlier versions, which can be...