PYSEC-2015-5

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

IBM WebSphere Application Server Information Disclosure Vulnerability (CNVD-2014-09181)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An information disclosure vulnerability exists in IBM...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2014-09213)

IBM Rational Quality Manager is a Web-based collaboration tool that provides a sophisticated approach to test planning and test evaluation management within the software development lifecycle. A cross-site scripting vulnerability exists in IBM Rational Quality Manager versions 2.x through 2.0.1.1...

CVE-2014-8018

Cisco SA-20150106-CVE-2014-8018 describes a reflected XSS vulnerability in the web framework of Cisco Unified Communications Domain Manager (BVSM pages) allowing unauthenticated remote attackers to inject arbitrary script via a crafted link. Root cause: improper validation of user-supplied input....

CVE-2014-3187

Vulnerability CVE-2014-3187 affects Google Chrome on iOS: Chrome versions prior to 37.0.2062.60 and 38.x prior to 38.0.2125.59 fail to restrict processing of facetime:// and facetime-audio:// URLs, allowing a crafted website to obtain video and audio data from the device. Affected component is th...

CVE-2014-3304

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...

Design/Logic Flaw

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...

CVE-2014-3320

Multiple open redirect vulnerabilities in the admin web interface in the web framework in Cisco Unified Communications Domain Manager CDM 8.1.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted URLs for unspecified scripts, aka Bu...

interactive story 1.3 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3028/info Interactive Story is a web-based application written in Perl and is distributed as freeware. Interactive Story does not filter '../' sequences from user input submitted to a hidden file called 'next'. Remote...

guido frassetto sedum http server 2.0 - Directory Traversal vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2335/info A remote user could gain read access to known files outside of the root directory in a SEDUM HTTP Server. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose the requested file...

IMG2ASCII - Cross Site Scripting Vulnerability

No description provided by source. ======================================================================================== | Title : IMG2ASCII Cross Site Scripting Vulnerability | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

Cisco Identity Services Engine Blind SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to impact the integrity and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input in SQL...

Microsoft SharePoint Callback Function Elevation of Privilege (MS13-024) - Ver2 (CVE-2013-0080)

An information disclosure and elevation of privilege vulnerability has been reported in Microsoft SharePoint. The vulnerability is due to an error in the way Microsoft SharePoint handles specially crafted URLs containing malicious JavaScript elements. A remote attacker may exploit this issue by...

PT-2014-1326 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 8.2 before 8.25.47 Cisco Adaptive Security Appliance ASA Software versions 8.3 before 8.32.40 Cisco Adaptive Security Appliance ASA Software versions 8.4 before 8.47.3 Cisco Adaptive...

Cisco Unified Communications Manager CAPF Unauthenticated Blind SQL Injection Vulnerability

A vulnerability in the Certificate Authority Proxy Function CAPF of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate...

Cisco Unified Communications Manager Enterprise Mobility Application Blind SQL Injection Vulnerability

A vulnerability in the Enterprise Mobility Application EMApp interface of Cisco Unified Communications Manager Cisco Unified CM could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a failure to valida...

Cisco Unified Communications Manager CMIVR Blind SQL Injection Vulnerability

A vulnerability in the Cisco Unified Communications Manager UCM Unified CallManager Interactive Voice Response CMIVR interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input...

Cisco Unified Communications Manager IPMA Blind SQL Injection Vulnerability

A vulnerability in the Cisco Unified Communications Manager UCM IP Manager Assistant IPMA interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied...

CVE-2013-4200 - Plone URL redirection / Forwarding of cookie data (session hijack) in certain browsers

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart [email protected]...

Cisco Unified Presence Server SQL Injection Vulnerability

A vulnerability in the web interface of Cisco Unified Presence Server could allow an authenticated, remote attacker to impact the confidentiality, integrity, and availability of the affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied...