OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...

Unspecified Vulnerability in Oracle Hospitality Applications

Oracle Hospitality Applications is a software from Oracle Corporation. A vulnerability in the "OPERA Application Login" of Oracle Hospitality Applications could be exploited by a remote attacker via the 'HTTP' protocol, affecting the confidentiality, integrity, and availability of the system...

Wordpress simplified-content plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers. simplified-content is one of the plug-ins used to simplify the content. A cross-site scripting vulnerability exists in...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

Cisco Firepower Threat Management Console Denial of Service Vulnerability

Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. A denial of service attack vulnerability exists in the Cisco Firepower Threat Management Console, which allows a remote attacker to cause a denial of service by sending ...

The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code.

The vulnerability of the Cisco IOS operating system allows a hacker to inject any desired Web or HTML code...

CVE-2016-5273

The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site...

UBUNTU-CVE-2016-5273

The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site...

IBM Rational Quality Manager and Collaborative Lifecycle Management Command Injection Vulnerability

IBM Rational Quality Manager RQM and Collaborative Lifecycle Management CLM are both products of IBM Corporation. The former is a set of collaborative, Web-based quality management solutions, the latter is a set of collaborative lifecycle management solutions. A command injection vulnerability...

BINOM3 Electric Power Quality Meter Sensitive Information Disclosure Vulnerability

The BINOM3 Electric Power Quality Meter is a universal multifunctional power quality monitor. BINOM3 Electric Power Quality Meter is vulnerable to sensitive information disclosure. Since the management portal is configured for HTTP by default, an attacker in the right position could sniff all log...

PHP Denial of Service Vulnerability (CNVD-2016-07712)

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and support for C, C++ for program extensions and so on. A...

CVE-2016-6839

CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

HTTP Information Disclosure Vulnerability

HTTP HyperText Transfer Protocol is one of the most widely used network protocols on the Internet. HTTP was designed to provide a means of publishing and receiving HTML pages, and the resources requested through the HTTP protocol are identified by Uniform Resource Identifiers URIs.HTTP/2 is one o...

Siemens SIPROTEC 4/SIPROTEC Compact Denial of Service Vulnerability

SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of centralized protection, control and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 4, SIPROTEC Compact devices, versions prior to EN100 Ethernet 4.29. A remot...

Novell GroupWise HTML Injection Vulnerability

Novell GroupWise is a cross-platform collaboration software. An HTML injection vulnerability exists in Novell GroupWise 2014 SP1, 2014 R2 SP1, and 2014 versions, which stems from the program failing to adequately filter user-submitted input. An attacker could be allowed to exploit the vulnerabili...

Foreman HTML Injection Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. An HTML injection vulnerability exists in Foreman, which arises from the program's failure to adequately...

PHP SPL Extended Integer Overflow Vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community.SPL Standard PHP Library is a collection of interfaces and class extensions for solving typical problems. SPL Standard PHP Library is an extensio...

PHP Gettext Remote Code Execution Vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and program extensions in C, C++, etc. Gettext is one of the...

spacewalk-java: Multiple XSS flaws

A stored cross-site scripting XSS flaw was found in the way spacewalk-java displayed group names. An attacker can embed HTML and Javascript in the values for group names in Satellite, allowing them to inject malicious content into the web page that is then displayed when viewing the snapshot data...