CVE-2015-2804: Exposure of Sensitive Information to an Unauthorized Actor

The management web interface in Alcatel-Lucent OmniSwitch 6450, 6250, 6850E, 9000E, 6400, and 6855 with firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02 generates weak session identifiers, which allows remote attackers to hijack arbitrary sessions via a brute force attack...

Apache Sling API and Sling Servlets Cross-Site Scripting Vulnerabilities

Apache Sling API is the United States Apache Apache Software Foundation's set of frameworks for building Web applications. Apache Sling Servlets Post is one of the container. Apache Sling API and Sling Servlets have a cross-site scripting vulnerability. Allow remote attackers to exploit the...

CVE-2015-3090

creationtimestamp| type| source ---|---|--- 2015-05-27 07:14:54+00:00| seen| MISP/55656ec4-8154-41ea-a1ce-42c7950d210b 2015-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/37368 2015-06-25 10:59:48+00:00| seen| MISP/558bdeda-4ff0-463c-aac5-4b9e950d210b 2018-05-29...

Sendio ESP Information Disclosure Vulnerability

Exploit for jsp platform in category web applications 1. Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of...

Sendio ESP - Information Disclosure

Sendio ESP - Information Disclosure 1. Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of last update:...

Google Chrome Input Validation Vulnerability (CNVD-2015-03346)

Google Chrome on Android is a web browser developed by the American company Google Google for the Android platform. A security vulnerability exists in the android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java file in versions of Google Chrome prior to 43.0.2357.65 on the Android...

Microsoft Windows DNS Server Spoofing - Ver2 (CVE-2007-3898)

There exits a vulnerability in Microsoft Windows DNS Server. The flaw is caused by predictable transaction identifiers in DNS requests generated. A remote attacker may leverage this vulnerability to use spoofed DNS responses to poison the DNS cache on the target system...

Trend Micro ScanMail for Microsoft Exchange Authentication Bypass Vulnerability

Trend Micro ScanMail for Microsoft Exchange is a virus scanning program for Exchange mail servers. Trend Micro ScanMail for Microsoft Exchange SMEX prior to 10.2 Hot Fix Build 3318 and prior to 11.0 Hot Fix Build 4180 uses a guessable random number generator to generate the session ID of the WEB...

Huawei SEQ Analyst suffers from multiple cross-site scripting vulnerabilities

Huawei SEQ Analyst is a solution with proven big data storage and analysis capabilities. Huawei SEQ Analyst fails to properly filter multiple parameters, which can be exploited by a remote attacker to construct malicious URIs and trick users into parsing them, which can obtain sensitive cookies,...

Novell ZENworks Session ID Disclosure Vulnerability

Novell ZENworks is a suite of software that supports automated IT management and business process management across resources within an organization. A security vulnerability in the Rtrlet.class class of Novell ZENworks allows remote attackers to submit a special POST request to obtain sensitive...

GLSA-201504-04 : Xen: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201504-04 Xen: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact : A local attacker could possibly cause a Denial of Service...

CVE-2015-1114

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Design/Logic Flaw

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Code injection

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

CVE-2015-1114

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

PT-2015-5098

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.3 Apple TV versions prior to 7.2 Description The issue allows attackers to discover hardware identifiers via a crafted app, specifically affecting the Sandbox Profiles component. Recommendations For Apple iOS...

CVE-2015-1114: Exposure of Sensitive Information to an Unauthorized Actor

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

GLSA-201406-11 : libXfont: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-11 libXfont: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libXfont. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could use a specially...