CVE-2015-6259

CVE-2015-6259 affects Cisco Integrated Management Controller (IMC) Supervisor prior to 1.0.0.1 and Cisco UCS Director prior to 5.2.0.1. The JSP component enables remote attackers to overwrite arbitrary files via crafted HTTP requests, a vulnerability tracked as CSCus36435/CSCus62625. The issue is...

Cisco Patches File Overwrite Bug in IMC Supervisor and UCS Director

Cisco has patched a remote file-overwrite vulnerability in a couple of its products that could allow an attacker to replace arbitrary files and cause target systems to become unstable. The vulnerability affects the Cisco Integrated Management Controlled Supervisor and UCS Director software. The...

Shopify: www.shopify.com XSS on blog pages via sharing buttons

social sharing buttons facebook and linkedin vulnerable to xss at www.shopify.com/guides/ www.shopify.com/videos/ and www.shopify.com/success-stories/ steps to reproduce: - go to page https://www.shopify.com/videos/pop-up-shop?x=';alert1// - share this page by clicking facebook or linkedin sharin...

jakarta security update

CentOS Errata and Security Advisory CESA-2015:1695 Updated jakarta-taglibs-standard packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring Syste...

Cisco Identity Services Engine Access Control Bypass Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A security vulnerability exists in the Cisco Identity Services Engine that allows a remote user to submit a special HTTP request to access arbitrarily customized HTML pages on the target Guest portal system...

WordPress Legal Pages Plugin <= 1.0.1 - Cross Site Scripting (XSS)

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

Netsweeper 4.0.4 - SQL Injection

Netsweeper 4.0.4 - SQL Injection +----------------------------------+ + Netsweeper 4.0.4 - SQL Injection + +----------------------------------+ Affected Product: Netsweeper Vendor Homepage : www.netsweeper.com Version : 4.0.4 and probably other versions Discovered by : Anastasios Monachos secuid0...

Apple Safari Interface Forgery Vulnerability

Apple Safari is an open source WEB browser. An interface forgery vulnerability exists in Apple Safari, which allows remote attackers to exploit the vulnerability to construct malicious web pages and trick users into parsing them to obtain sensitive information...

Mozilla Firefox JSON Parsing Same Origin Policy Bypass Vulnerability

Mozilla Firefox is an open source WEB browser. Mozilla Firefox suffers from a security vulnerability when parsing JSON, which allows remote attackers to construct malicious WEB pages and trick users into parsing them, redefine non-configurable attributes on JavaScript objects, and bypass the...

Mozilla Firefox suffers from an unspecified memory corruption vulnerability (CNVD-2015-05436)

Mozilla Firefox is an open source WEB browser. An unspecified memory corruption vulnerability exists in Mozilla Firefox that allows remote attackers to construct a malicious web page and trick users into parsing it, which could crash the application or execute arbitrary code...

Mozilla Firefox WebM Video Processing Buffer Overflow Vulnerability (CNVD-2015-05432)

Mozilla Firefox is an open source WEB browser. Mozilla Firefox handles WebM video with a Libvpx stock in buffer overflow vulnerability that allows remote attackers to construct malicious WEB pages and trick users into parsing them, which can crash the application or execute arbitrary code...

Mozilla Firefox suffers from an unspecified memory corruption vulnerability (CNVD-2015-05438)

Mozilla Firefox is an open source WEB browser. An unspecified memory corruption vulnerability exists in Mozilla Firefox, which allows remote attackers to construct a malicious web page and trick users into parsing it, which could crash the application or execute arbitrary code...

Unauthorized Access Vulnerability in Large Rotating Machinery Online Monitoring and Analysis System of Shenyang Blower Group

Online monitoring and analysis of large rotating machinery is a system for detecting and analyzing the safe and efficient operation of large units and preventing vicious accidents. Shenyang Blower Group unauthorized access vulnerability of large-scale rotating machinery online monitoring and...

Open redirect

Open redirect vulnerability in the Content Construction Kit CCK 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages...

CVE-2015-5510

Open redirect vulnerability in the Content Construction Kit CCK 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages...

Apple Safari WebKit Security Bypass Vulnerability

Apple Safari is an open source WEB browser. A security vulnerability exists in Apple Safari that allows remote attackers to exploit a vulnerability to build malicious web pages, trick users into parsing them, and bypass Content Security Policy restrictions...

CVE-2015-5475

Multiple cross-site scripting XSS vulnerabilities in Request Tracker RT 4.x before 4.2.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to the 1 user and 2 group rights management pages...

PDF Shaper Buffer Overflow

This module requires Metabuffer: http://metabuffer.com/download Current source: https://github.com/rapid7/metabuffer-framework require 'msf/core' class Metasploit3 'PDF Shaper Buffer Overflow', 'Description' = %q PDF Shaper is prone to a security vulnerability when processing PDF files. The...

PortletBridge: information disclosure via auto-dispatching of non-JSF resources

It was found that PortletBridge PortletRequestDispatcher did not respect security constraints set by the servlet if a portlet request asked for rendering of a non-JSF resource such as JSP or HTML. A remote attacker could use this flaw to potentially bypass certain security constraints and gain...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20150722)

A flaw was found in the way Linux kernel's Transparent Huge Pages THP implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugepages. CVE-2014-3940, Moderate A buffer overflow flaw was found in the way the Linu...