httpd security update

2.2.15-60.0.1.6 - replace index.html with Oracle's index page oracleindex.html - update vstring in specfile 2.2.15-60.6 - Resolves: 1493061 - CVE-2017-9798 httpd: various flaws...

httpd security and bug fix update

2.2.15-60.0.1.4 - replace index.html with Oracle's index page oracleindex.html - update vstring in specfile 2.2.15-60.4 - Related: 1427675 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects 2.2.15-60.3 - Resolves: 1463205 - CVE-2017-7668 httpd: apfindtoken buffer overread...

PT-2017-18510

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered that allows for cross-site scripting XSS in the courier/1000@/index.html endpoint with the auth params parameter. The device attempts to mitigate specific XSS...

CVE-2017-8760: Improper Neutralization of Input During Web Page Generation

An issue was discovered on Accellion FTA devices before FTA912180. There is XSS in courier/1000@/index.html with the authparams parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However, these can be bypassed by using some modifications to the payloads,...

httpd security and bug fix update

2.4.6-45.0.1.4 - replace index.html with Oracle's index page oracleindex.html 2.4.6-45.4 - Resolves: 1396197 - Backport: modproxywstunnel - AH02447: err/hup on backconn 2.4.6-45.3 - prefork: fix delay completing graceful restart 1327624 - modldap: fix authz regression, failing to rebind 1415257...

CVE-2016-5667: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html...

Oracle Linux 5 / 6 : httpd (ELSA-2016-1421)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1421 advisory. 2.2.3-92.0.1 - Add the ability to read DH parameters from the first SSLCertificateFile John Haxby orabug 21671194 - fix modssl always performing full...

httpd security update

2.2.3-92.0.1 - Add the ability to read DH parameters from the first SSLCertificateFile John Haxby orabug 21671194 - fix modssl always performing full renegotiation Joe Jin orabug 12423387 - replace index.html with Oracle's index page oracleindex.html - update vstring and distro in specfile 2.2.3-...

printivate.com XSS vulnerability

Vulnerable URL: https://printivate.com/api/index.html?url=https://gist.githubusercontent.com/anonymous/4a5ece3c91b803536c3a81811af24225/raw/cb666406da086e666a74cf9219fcdc2e07100d9f/5742c4bee4b01190df6d640c.json Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017...

New Ransomware KimcilWare Targets Magento Websites

New ransomware called KimcilWare is targeting websites running the Magento ecommerce platform, used by the likes of Vizio, Olympus and Nike. According to security experts from the online community BleepingComputer, hackers exploit vulnerabilities in the Magento ecommerce platform and install the...

cf.ekoloko.com XSS vulnerability

Vulnerable URL: http://cf.ekoloko.com/index.html?refCode=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Googl...

CVE-2015-0967: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via 1 the search field in plugin/index.html or 2 the title field in the Create Featured Result form in admin/main.jsp...

PT-2015-4993

Name of the Vulnerable Software and Affected Versions SearchBlox versions prior to 8.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via two main avenue...

CVE-2015-1773: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitrary web script or HTML by providing a crafted URI to JavaScript code generated by the asdoc component...

PT-2015-5438

Name of the Vulnerable Software and Affected Versions Apache Flex versions prior to 4.14.1 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML by providing a crafted URI to JavaScript code generated by the asdoc component. This...

Code injection

Elipse E3 3.x and earlier allows remote attackers to cause a denial of service application crash and plant outage via a rapid series of HTTP requests to index.html on TCP port 1681...

PT-2014-8658

Name of the Vulnerable Software and Affected Versions Elipse E3 versions 3.x and earlier Description The issue allows remote attackers to cause a denial of service, resulting in an application crash and potentially a plant outage. This can be achieved by sending a rapid series of HTTP requests to...

CVE-2014-8652: Undefined Security Weakness

Elipse E3 3.x and earlier allows remote attackers to cause a denial of service application crash and plant outage via a rapid series of HTTP requests to index.html on TCP port 1681...

File Manager v4.2.10 iOS - Code Execution Vulnerability

Document Title: =============== File Manager v4.2.10 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1343 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID: ==================================== 13...

File Manager v4.2.10 iOS - Code Execution Vulnerability

Document Title: =============== File Manager v4.2.10 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1343 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID: ==================================== 13...