CVE-2015-0132: Undefined Security Weakness

The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a deni...

CVE-2014-6129: Undefined Security Weakness

IBM Rational Jazz Team Server JTS, as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x...

PT-2015-4493

Name of the Vulnerable Software and Affected Versions IBM Rational DOORS Next Generation versions 4.x before 4.0.7 iFix3 IBM Rational DOORS Next Generation versions 5.x before 5.0.2 IBM Rational Requirements Composer versions 2.x and 3.x before 3.0.1.6 iFix5 IBM Rational Requirements Composer...

PT-2015-3815

Name of the Vulnerable Software and Affected Versions IBM Rational Jazz Team Server JTS versions 3.x through 4.0.7 before iFix4 IBM Rational Jazz Team Server JTS versions 5.x before 5.0.2 iFix2 Rational Collaborative Lifecycle Management versions 3.x through 4.0.7 before iFix4 Rational...

Fortimail 5.2.1 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected vulnerabilities in Fortimail version 5.2.1 II. BACKGROUND ------------------------- Fortinet’s industry-leading, Network Security Platforms deliver Next Generation Firewall NGFW security with exceptional throughput, ultra low latency, and...

Security feature bypass

The CryptProtectMemory function in cng.sys aka the Cryptography Next Generation driver in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gol...

PT-2015-4392

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold an...

MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution (3036220)

The remote Windows host is missing a security patch. It is, therefore, affected by the following vulnerabilities : - A privilege escalation vulnerability exists in the Windows kernel-mode driver that is caused by improperly handling objects in memory. CVE-2015-0003, CVE-2015-0057 - A security...

PT-2015-5243

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the order by parameter to various endpoints such as "credentials/", "inventories/", "projects/...

WS-2014-0046

In “Cloudera/Hue”, in cdh4.5.0 to cdh5.3.10 and release-3.5.0 to release-3.7.1, there is an open redirection vulnerability. An attacker can manipulate the '?next=' parameter and once a user successfully logins to the site, there will be a redirection to the attacker’s site...

Next Generation Snort IPS: Snort3

The Snort++ project has been hard at work for a while now and we have released the third alpha of the next generation Snort IPS Intrusion Prevention System. This file will show you what Snort++ has to offer and guide you through the steps from download to demo. If you are unfamiliar with Snort yo...

Meterpreter over SSH – MeterSSH

Meterpreter over SSH As penetration testers, it’s crucial to identify what types of attacks are detected and what’s not. After running into a recent penetration test with a next generation firewall, most analysis has shifted away from the endpoints and more towards network analysis. While there...

McAfee Next Generation Firewall GNU Bash Code Injection (SB10085) (Shellshock)

The remote host has a version of McAfee Next Generation Firewall NGFW installed that is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables...

Cisco ASA Next-Generation Firewall GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)

The remote ASA Next-Generation Firewall NGFW host is missing a security patch. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment...

PT-2014-8453

Name of the Vulnerable Software and Affected Versions In-Portal CMS versions 5.2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the next template parameter to "admin/index.php". Recommendations For In-Portal CMS versions...

CVE-2014-6735

The imagine Next bmobile aka com.conduit.app51c3c19581af465092327dd25591b224.app application 1.7.10.243 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6735

The CVE-2014-6735 entry concerns the Android app “imagine Next bmobile” (com.conduit.app_51c3c19581af465092327dd25591b224.app) version 1.7.10.243, where SSL/TLS certificate verification is not performed, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a ...

PT-2014-7413

Name of the Vulnerable Software and Affected Versions imagine Next bmobile aka com.conduit.app 51c3c19581af465092327dd25591b224.app version 1.7.10.243 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the...

CVE-2014-6735: Undefined Security Weakness

The imagine Next bmobile aka com.conduit.app51c3c19581af465092327dd25591b224.app application 1.7.10.243 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

AneCMS /registre/next - SQL Injection Vulnerability

No description provided by source. Exploit Title: anecms SQli Date: 23/08/2010 Author: Sweet Contact : [email protected] Software Link: anecms.com Download: anecms.com/anecms.zip Version: All Tested on: WinXp sp3 Description : anecms is an open source blog manager...