9089 matches found
Open-Xchange Server and Open-Xchange AppSuite Front End Cross-Site Scripting Vulnerabilities
Open-Xchange Server is a semi-open source project mainly used for developing collaboration software; OX AppSuite is a set of Web cloud desktop environment. A cross-site scripting vulnerability exists in the dialogs for printing content in the Front End of Open-Xchange Server and OX AppSuite, whic...
Imgur: Server Side Request Forgery In Video to GIF Functionality
imgur.com is vulnerable to Server Side Request Forgery because it fails to sanitize or verify the "url" GET parameter. This could be used by attackers to launch attacks against other 3rd party sites or proxy an attackers requests through the affected site to hide the attackers origin. In more...
Server: PHP arbitrary class instantiation in "files_external"
A user may instantiate arbitrary ownCloud classes due to a lack of a proper check of the mount point options provided by a user via the web front end. These may include constructor arguments and could potentially lead to a remote code execution. For more information please consult the official...
SOL17309 - Linux kernel vulnerability CVE-2015-5366
Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...
HackerOne Vulnerability Coordination Maturity Model
The proliferation of independent and vendor-sponsored bug bounties has not only put some money in researchers’ pockets, but has also forced enterprises—and software makers—to put processes in place to handle outside bug reports. “Saying you want one is not enough,” said Katie Moussouris, chief...
ZTE PC UI USB Modem Software - Local Buffer Overflow
ZTE PC UI USB Modem Software - Local Buffer Overflow !/usr/bin/python -w Title : ZTE PC UI USB MODEM SOFTWARE Buffer Overflow Date : 17/09/2015 Author : R-73eN Tested on : Windows Xp sp3 on software Eagle Speed PCWEAGLEALBp671A1V1.0.0B02 Since all the PC UI based software shares the same source...
ZTE PC UI USB Modem Software - Local Buffer Overflow
!/usr/bin/python -w Title : ZTE PC UI USB MODEM SOFTWARE Buffer Overflow Date : 17/09/2015 Author : R-73eN Tested on : Windows Xp sp3 on software Eagle Speed PCWEAGLEALBp671A1V1.0.0B02 Since all the PC UI based software shares the same source code they are all vulnerable.Confirmed By ZTE The...
phpcms投票功能前台代码执行
No description provided by source...
KLA10803 VMware Workstation 10.x end of life
VMware announced the end of support for VMware Workstation 10.x. Users should immediately make transition to VMware Workstation 11.x or later Original advisories https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/product-lifecycle-matrix.pdf Related products...
Weak Password Vulnerability in Government Website Management System of E-Tron Networks
E-Tron web government website management system is a system for government Internet access system, government website system customization services. A weak password vulnerability exists in part of the back-end of the NetGov ad management system. An attacker can utilize the vulnerability to log in...
Threat Outbreak Alert RuleID17312: Email Messages Distributing Malicious Software on August 12, 2015
Medium Alert ID: 40418 First Published: 2015 August 12 14:05 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17312 may contain the following files: Name |...
Discuz 前台回帖 存储型 DOM XSS
产生原因： JS原生取ELEMENT中HTML内容的方法，会将服务端转义过的单双引号实体编码进行反转。 代码分析： 这里有payload: align="onmouseover="alert1, 那么就从payload开始往回看漏洞是怎么产生的 align="onmouseover="alert1 回帖之后payload显示如上述所示, 跟进 管理员/版主 编辑帖子时的操作 var editorid = 'e'; var textobj = $editorid + 'textarea'; 这里得到textobj = 'etextarea' /static/js/common.js...
Important: Red Hat Security Advisory: java-1.5.0-ibm security update
Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...
CVE-2015-4289
Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.02049 allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920...
Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability
A vulnerability in the connection establishment process of Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, remote attacker to write or overwrite files in the active user's context. The vulnerability is due to insufficient input validation. An unauthenticated, remote attack...
[SECURITY] [DSA 3314-1] typo3-src end of life
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3314-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 23, 2015 https://www.debian.org/security/faq -...
DSA-3314-1 typo3-sec - end of life
Bulletin has no description...
System: multiple XSS flaws
Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a cross-site scripting XSS attack against victims using the Certificate System's web interface...
curl: URL request injection vulnerability in parseurlandfillconn()
It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct...
