CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

CVE-2014-6393

CVE-2014-6393 affects the Express web framework for Node.js (versions prior to 3.11 and 4.x prior to 4.5). Root cause: missing charset field in HTTP Content-Type headers for 400-level responses, enabling potential XSS via non-standard encodings. Affected component/file: Express’s Content-Type han...

CVE-2014-6393

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

CVE-2014-6393: Improper Neutralization of Input During Web Page Generation

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting XSS attacks via characters in a non-standard encoding...

PT-2017-5975

Name of the Vulnerable Software and Affected Versions: Express versions 3.x before 3.11 Express versions 4.x before 4.5 Description: The issue arises from the lack of a charset field in HTTP Content-Type headers in 400 level responses, potentially allowing remote attackers to conduct cross-site...

Microsoft Express Compressed Fonts Remote Code Execution Vulnerability (KB4035056)

This host is missing an important security update according to Microsoft KB4035056 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2017-8691

Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font library fails to properly handle specially crafted embedded fonts, aka "Express Compressed Fonts Remote Code Execution Vulnerability."...

KLA11846 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2017-6747

A vulnerability in the authentication module of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An...

Redirection Vulnerability Open in Multiple IBM Products

IBM WebSphere Commerce Enterprise and others are products of IBM Corporation in the U.S. IBM WebSphere Commerce Enterprise is a suite of e-commerce solutions for high-volume B2C and B2B business models and multiple e-commerce sites; Express is a suite of business intelligence and planning...

Threat Outbreak Alert RuleID29706: Email Messages Distributing Malicious Software on July 7, 2017

Medium Alert ID: 54437 First Published: 2017 July 7 12:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29706 may contain the following files: Name | Size...

parklandbookstore.com XSS vulnerability

Vulnerable URL: http://www.parklandbookstore.com/textbookexpress/gettxtexpress.asp?remote=1=2023==SUMMER%202017=CHE=106=1"...

Authentication flaw

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...

CVE-2017-6722

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...

PT-2017-17274

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Express UCCx versions 10.61 through 11.51.10000.60 Description A vulnerability in the Extensible Messaging and Presence Protocol XMPP service could allow an unauthenticated, remote attacker to masquerade as a...

CVE-2017-6722: Improper Authentication

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...

Niushop open source mall system v1.05 beta 20170622 getMemberExpressAddress method has a SQL injection vulnerability

NiuShop open source mall system, is a PHP open source e-commerce system. Niushop open source mall system v1.05 beta 20170622 getMemberExpressAddress method SQL injection vulnerability. The vulnerability due to the system id parameter does not filter the data submitted by the user , a remote...

Cisco Unified Contact Center Express Security Bypass Vulnerability

Cisco Unified Contact Center Express is a single-server, integrated contact center for formal and informal contact centers. A security bypass vulnerability exists in the Extensible Messaging and Presence Protocol XMPP service for Cisco Unified Contact Center Express UCCx, which can be exploited b...