PT-2015-5403

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. Recommendations For Microsoft Exchange Server...

CVE-2015-1630: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."...

CVE-2015-1629: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Outlook Web App OWA in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability."...

Microsoft Exchange Error Message Cross Site Scripting (MS15-026; CVE-2015-1632)

An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by enticing a victim to open a specially crafted URL...

Directory traversal

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions

It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute...

Default credentials

The ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL...

CVE-2015-1618

The ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL...

CVE-2015-1618

The CVE-2015-1618 issue affects the McAfee Data Loss Prevention Endpoint (DLPe) ePO extension prior to 9.3.400. A remote, authenticated user can obtain sensitive password information via a specially crafted URL, due to insufficient access checks in the ePO extension. Impact is information disclos...

CVE-2015-1618: Exposure of Sensitive Information to an Unauthorized Actor

The ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL...

CVE-2014-8909

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8909

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8909: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 mainpage.jsp and 2 GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8893

Multiple cross-site scripting XSS vulnerabilities in 1 mainpage.jsp and 2 GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Multiple Cross-Site Scripting Vulnerabilities in IBM TRIRIGA Application Platform

The IBM TRIRIGA Application Platform is a scalable technology platform for deploying IBM TRIRIGA applications. Multiple cross-site scripting vulnerabilities in IBM TRIRIGA Application Platform versions 3.2.1.x, 3.3.2.2 before 3.3.2.3, and 3.4.1.1 before 3.4.1.1 could allow a remote, authenticated...

IBM TRIRIGA Application Platform Security Bypass Vulnerability

The IBM TRIRIGA Application Platform is a scalable technology platform for deploying IBM TRIRIGA applications. A security bypass vulnerability in IBM TRIRIGA Application Platform versions 3.2.1.x, 3.3.2.2 prior to 3.3.2.3, and 3.4.1.1 prior to 3.4.1.1 allows a remote attacker to bypass intended...