CVE-2016-0218

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security...

U.S. Dept Of Defense: Server side information disclosure on a DoD website

A misconfigured Department of Defense webserver improperly disclosed application information. @sulemanmalik03 was able to demonstrate this vulnerability by crafting specially formatted URLs...

U.S. Dept Of Defense: Server Side Request Forgery (SSRF) vulnerability in a DoD website

A Department of Defense webserver was vulnerable to an SSRF attack that could have enabled a remote user to send custom web requests from the vulnerable system. @korprit was able to demonstrate this vulnerability by crafting specially formatted URLs. Thanks @korprit!...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

CVE-2016-7146

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting XSS" issue affecting the action=fckdialog&dialog=attachment via page name component...

FortiDDoS Command Injection Vulnerability Announcement

A vulnerability in FortiDDoS allows escalation of privilege via remote OS injection through crafted URLs sent to the GUI. The user is required to be logged in for an exploit to work...

IBM Spectrum Control and IBM Storage Insights Catalog Traversal Vulnerability

IBM Spectrum Control and IBM Storage Insights are both storage resource management software from IBM USA. A directory traversal vulnerability exists in IBM Spectrum Control versions 5.2.8 through 5.2.10.1 and IBM Storage Insights. An attacker can exploit this vulnerability by sending a URL reques...

Concrete CMS: Content Spoofing possible in concrete5.org

An attacker can include any arbitrary text using specially crafted concrete5 url. This is done using character /%0d%0a. Input https://www.concrete5.org/%0d%0ahas%20moved%20to%20www.evil.com.Please%20visit%20evil.com%20Present%20resource Output The requested URL / has moved to www.evil.com.Please...

IBM BigFix Cross-Site Scripting Vulnerability

IBM BigFix formerly known as IBM Endpoint Manager, Tivoli Endpoint Manager is a suite of systems management software from the American company IBM. A cross-site scripting vulnerability exists in the BES Gather feature of the IBM BigFix platform, which can be exploited by remote attackers with the...

ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting XSS vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSSOPERATION' parameter. An unauthenticated, remote attacker can exploit this, v...

The vulnerability of the network virtualization tool for testing software from HP Network Virtualization allows a hacker to read arbitrary files.

The vulnerability of the network virtualization tool for testing software from HP Network Virtualization. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files using a specially crafted URL when accessing components like HttpServlet or...

Cisco Prime Collaboration Deployment SQL Injection Vulnerability

A vulnerability in the interface of the Cisco Prime Collaboration Deployment SQL database could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation for user-supplied input in...

IBM Rational Engineering Lifecycle Manager Information Disclosure Vulnerability

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A security vulnerability in IBM Rational Engineering Lifecycle Manager allows remote attackers to submit specially crafted URLs to obtain sensitive information...

Cisco Cloud Network Automation Provisioner SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Cloud Network Automation Provisioner CNAP could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input in SQL...

Important: mercurial

Issue Overview: It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code. CVE-2016-3068 The binary delta decoder in Mercurial before 3.7...

Cisco TelePresence Server Denial of Service Vulnerability (CNVD-2016-02065)

Cisco TelePresence is a Cisco TelePresence solution. Cisco TelePresence Server versions 4.12.29-4.24.17 HTTP parsing engine fails to properly handle constructed URLs, which can allow an unauthenticated, remote attacker to cause reloading of the affected device...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerabilities of the browser/devtools/devtoolsuibindings.cc and WebKit/Source/devtools/frontend/Runtime.js functions within the Developer Tools subsystem of the Google Chrome browser are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to...

Fedora 22 : git-2.4.3-7.fc22 (2015-cf767c77c1)

git-2.1.0-6.fc21 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.4.3-7.fc22 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.5.0-2.fc23 - fix arbitrary code execution via crafted URLs Resolves: 1269797 Note that Tenable Network Security has extracted...

Fedora 23 : git-2.5.0-2.fc23 (2015-05b74288af)

git-2.1.0-6.fc21 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.4.3-7.fc22 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.5.0-2.fc23 - fix arbitrary code execution via crafted URLs Resolves: 1269797 Note that Tenable Network Security has extracted...

Multiple XSS vulnerabilities.

PMASA-2016-11 Announcement-ID: PMASA-2016-11 Date: 2016-02-25 Summary Multiple XSS vulnerabilities. Description By sending a specially crafted URL as part of the HOST header, it is possible to trigger an XSS attack. A weakness was found that allows an XSS attack with Internet Explorer versions...