Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Description Microsoft Exchange Server is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the same-origin policy, obtain sensitive information and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks...

WordPress Church Admin Plugin 0.800 - Stored XSS

Better Church Admin plugins is prone to a stored XSS vulnerability that allow to steal cookies or gain privileged access to the affected site. Solution Fixed in version 0.810...

Mozilla Firefox Multiple Vulnerabilities-01 (May 2015) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Microsoft Active Directory Federation Services CVE-2015-1638 Information Disclosure Vulnerability

Description Microsoft Active Directory Federation Services is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. Technologies Affected Microsoft Active Directory Federation Services 3.0...

Microsoft XML Core Services CVE-2015-1646 Same Origin Policy Security Bypass Vulnerability

Description Microsoft XML Core Services is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass the same-origin policy and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks. Technologies Affected Avaya CallPil...

Citrix Command Center - Credential Disclosure Vulnerability

It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this folder, decode passwords stored in these files, and gai...

Citrix Command Center - Credential Disclosure

Citrix Command Center - Credential Disclosure Abstract It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this...

Citrix Command Center - Credential Disclosure

Abstract It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this folder, decode passwords stored in these files...

Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability

A vulnerability in Cisco Virtual TelePresence Server Software could allow an authenticated, local attacker to access the shell of the underlying operating system with the privilege level of the root user. The vulnerability is due to undocumented privileged access through the serial connection,...

Authentication flaw

The administrative web-management portal in Cisco IX 8 .0.1 and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery...

Symantec Encryption Management Server Local Command Injection Vulnerability

Symantec Encryption Management Server is a single console for managing multiple encryption applications in the PGP platform. A command injection vulnerability exists in Symantec Encryption Management Server's handling of database backup recovery, which could be exploited by a remote attacker to...

CVE-2015-0513

Multiple cross-site scripting XSS vulnerabilities in the administrative user interface in EMC M&R aka Watch4Net before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the administrative user interface in EMC M&R aka Watch4Net before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified field...

CVE-2015-0513

Multiple cross-site scripting XSS vulnerabilities in the administrative user interface in EMC M&R aka Watch4Net before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified field...

Microsoft Exchange Server CVE-2014-6336 Tokens Validation URI Redirection Vulnerability

Description Microsoft Exchange Server is prone to a URI-redirection vulnerability. An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid ...

Privileged access to security wrapped protected objects — Mozilla

Mozilla developer Bobby Holley discovered two issues involving security wrappers...

Hikvision DVR RTSP Request Remote Code Execution

This module exploits a buffer overflow in the RTSP request parsing code of Hikvision DVR appliances. The Hikvision DVR devices record video feeds of surveillance cameras and offer remote administration and playback of recorded footage. The vulnerability is present in several models / firmware...

CVE-2014-3158

Integer overflow in the getword function in options.c in pppd in Paul's PPP Package ppp before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "corrupts security-relevant variables."...

Cisco UCS Director Default Credentials (SSH)

The account 'shelladmin' is using a default password. A remote, unauthenticated attacker can exploit this to log in as a privileged user and gain access to the Cisco UCS Director configuration menu. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid78768;...

F5 Networks BIG-IP : SSH vulnerability (K13600)

A platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using secure shell SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect. The following platforms a...