The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted U...

IBM WebSphere Application Server HTTP Response Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. There is a security vulnerability in IBM WAS. A remote...

UBUNTU-CVE-2016-1864

The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL...

The vulnerability of Google Chrome browser allows a hacker to manipulate the URL string.

The vulnerability of the WebContentsImpl::FocusLocationBarByDefault function content/browser/webcontents/webcontentsimpl.cc in the Google Chrome browser exists due to improper handling of calls to certain empty pages. Exploiting this vulnerability can allow a malicious actor to manipulate the URL...

The vulnerabilities of the data backup and application protection tools IBM Spectrum Protect Snapshot, as well as the virtual machine protection tools IBM Spectrum Protect for Virtual Environments, allow attackers to enhance their privileges.

The vulnerability of the Data Protection component in data backup and application solutions from IBM Spectrum Protect Snapshot, as well as in virtual machine protection solutions from IBM Spectrum Protect for Virtual Environments, is related to deficiencies in access control. Exploiting this...

CVE-2016-1314

Cross-site scripting XSS vulnerability in Cisco Unified Communications Domain Manager CDM 8.11 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux80760...

The vulnerability of the application interface of IBM WebSphere Portal servers allows a hacker to inject any Web or HTML code.

The vulnerability of the application interface of the IBM WebSphere Portal servers exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially crafted URL...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2016-01424)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects an organization internally and externally, allowing employees, customers and suppliers to access internal data through the platform. A cross-site scripting vulnerability exists in...

The vulnerability of the Internet Explorer browser, which allows a violator to obtain confidential information

The vulnerability of the Hyperlink Object Library component in Internet Explorer is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to obtain confidential information through a specially crafted URL in an email message or Office docume...

CVE-2016-0032

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."...

Newphoria applican framework cross-site scripting vulnerability

Newphoria applican framework for Android and iOS is a set of application development framework based on Android and iOS platforms from Newphoria, Japan. A cross-site scripting vulnerability exists in the runtime engine of Newphoria applican framework 1.12.6 and earlier for Android and Newphoria...

The vulnerabilities of Microsoft Lync Server and Skype for Business Server allow attackers to inject arbitrary web or HTML code.

The vulnerability of the jQuery server messaging components in Microsoft Lync Server and Skype for Business Server exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code through a special...

The vulnerability of the Business Process Manager system allows a perpetrator to inject arbitrary web or HTML code.

The vulnerability of the Business Process Manager system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code using a specially crafted URL...

The vulnerability of the iOS operating system, which allows a hacker to trigger a service failure

The vulnerability of the Safari component in the iOS operating system is related to improper data handling. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially crafted URL, due to the lack of restrictions on the number of JavaScript notifications...

JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions

It was found that Mojarra JavaServer Faces did not properly escape user-supplied content in certain circumstances. Contents of outputText tags and raw EL expressions that immediately follow script or style elements were not escaped. A remote attacker could use a specially crafted URL to execute...

USN-2474-1 curl vulnerability

Andrey Labunets discovered that curl incorrectly handled certain URLs when using a proxy server. If a user or automated system were tricked into using a specially crafted URL, an attacker could possibly use this issue to inject arbitrary HTTP requests...

UBUNTU-CVE-2014-6300

Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...

(Plone): Partial denial of service through internal function

It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values passed to an internal utility function. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive memory consumption...

(Plone): Partial denial of service through Collections functionality

It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive I/O and/or cache resource consumption...

PT-2014-4538 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue allows remote authenticated users to read files by sending a crafted URL to the HTTP server, potentially accessing sensitive information suc...