CVE-2014-4784

IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote attackers to conduct phishing attacks, and bypass intended access restrictions or obtain...

CVE-2014-4784

IBM Initiate Master Data Service (versions 9.5 prior to 9.5.093013, 9.7 prior to 9.7.093013, 10.0 prior to 10.0.093013, and 10.1 prior to 10.1.093013) is affected by a frame-injection issue where FRAME elements were not properly restricted, enabling phishing attacks and potential access restricti...

CVE-2014-4790

IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 do not properly restrict use of FRAME elements, which...

Design/Logic Flaw

IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 do not properly restrict use of FRAME elements, which...

CVE-2014-4790

The CVE-2014-4790 entry affects IBM Emptoris Sourcing Portfolio and Emptoris Spend Analysis. Affected.product components: Emptoris Sourcing Portfolio versions 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4; Emptoris Spend Analysis versions 9...

Sun Java System Identity Manager 6.0/7.0/7.1 /idm/help/index.jsp helpUrl Variable Remote Frame Injection

No description provided by source. source: http://www.securityfocus.com/bid/27214/info Sun Java System Identity Manager is prone to multiple input-validation vulnerabilities, including an HTML-injection issue and cross-site scripting issues, because it fails to adequately sanitize user-supplied...

Linux Kernel < 2.6.30.5 cfg80211 Remote Denial of Service Exploit

No description provided by source. / cfg80211-remote-dos.c Linux Kernel 2.6.30.5 cfg80211 Remote DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://patchwork.kernel.org/patch/41218/ These pointers can be NULL, the ismesh case isn't ever hit in the current kernel, but...

IBM Tivoli Directory Server 6.0.x / 6.1 < 6.1.0.58 / 6.2 < 6.2.0.33 / 6.3 < 6.3.0.25 Javadoc Frame Injection

According to its version, the installation of IBM Tivoli Directory Server on the remote host is 6.0.x or 6.1 6.1.0.58 / 6.2 6.2.0.33 / 6.3 6.3.0.25. It is, therefore, affected by an error related to the included Java version and input-validation that allows an attacker to inject HTML frames into...

OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous...

Apache Tomcat 6.0.x < 6.0.39 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 6.0.x listening on the remote host is prior to 6.0.39. It is, therefore, affected by the following vulnerabilities : - The version of Java used to build the application generates Javadoc containing a frame injection erro...

Mandriva Linux Security Advisory : tomcat6 (MDVSA-2014:042)

Updated tomcat6 packages fix security vulnerabilities : It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service CVE-2012-3544...

Updated tomcat6 packages fix multiple vulnerabilities and logging

Updated tomcat6 packages fix security vulnerabilities: It was discovered that Tomcat incorrectly handled certain requests submitted using chunked transfer encoding. A remote attacker could use this flaw to cause the Tomcat server to stop responding, resulting in a denial of service CVE-2012-3544....

Design/Logic Flaw

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection" issue...

CVE-2013-5407

CVE-2013-5407 affects IBM Sterling B2B Integrator 5.2 and IBM Sterling File Gateway 2.2 (and older 5.1/2.1 with 2.1). The frame injection vulnerability allows a remote attacker to use crafted web content to bypass access restrictions or access sensitive information by abusing FRAME elements. The ...

OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous...

OpenJDK: Frame injection in generated HTML (Javadoc, 8012375)

Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous...

Vulnerabilities in Avaya IP Office Customer Call Reporter

Hello 3APA3A! I want to warn you about vulnerabilities in Avaya IP Office Customer Call Reporter. These are Remote HTML Include and Remote XSS Include Cross-Site Scripting vulnerabilities. After I found multiple vulnerabilities in Avaya IP Office Customer Call Reporter in December, I informed ZDI...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2013-204)

Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. CVE-2013-2470 , CVE-2013-2471 ,...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2013-207)

Multiple flaws were discovered in the ImagingLib and the image attribute, channel, layout and raster processing in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. CVE-2013-2470 , CVE-2013-2471 ,...

Avaya IP Office Customer Call Reporter 8.0.9.13 XSS

Hello list! I want to warn you about vulnerabilities in Avaya IP Office Customer Call Reporter. These are Remote HTML Include and Remote XSS Include Cross-Site Scripting vulnerabilities. After I found multiple vulnerabilities in Avaya IP Office Customer Call Reporter in December, I informed ZDI...