[ERPSCAN-15-029] Oracle E-Business Suite - XXE injection Vulnerability

ADVISORY INFORMATION Title: Oracle E-Business Suite - XXE injection Advisory ID: ERPSCAN-15-029 Advisory URL: http://erpscan.com/advisories/erpscan-15-029-oracle-e-business-suite-xxe-injection-vulnerability/ Date published: 21.10.2015 Vendors contacted: Oracle 2. VULNERABILITY INFORMATION Class:...

Cisco ASA DHCPv6 Relay Function DHCP Packet Handling DoS (CSCur45455)

The remote Cisco Adaptive Security Appliance ASA device is affected by a denial of service vulnerability due to improper validation of DHCPv6 packets by the DHCPv6 relay function. An unauthenticated, remote attacker can exploit this, via specially crafted DHCPv6 packets, to cause a device reload...

CVE-2015-6324

The DHCPv6 relay implementation in Cisco Adaptive Security Appliance ASA software 9.0 before 9.04.37, 9.1 before 9.16.6, 9.2 before 9.24, 9.3 before 9.33.5, and 9.4 before 9.42 allows remote attackers to cause a denial of service device reload via crafted DHCPv6 packets, aka Bug IDs CSCus56252 an...

CVE-2015-6324

The DHCPv6 relay implementation in Cisco Adaptive Security Appliance ASA software 9.0 before 9.04.37, 9.1 before 9.16.6, 9.2 before 9.24, 9.3 before 9.33.5, and 9.4 before 9.42 allows remote attackers to cause a denial of service device reload via crafted DHCPv6 packets, aka Bug IDs CSCus56252 an...

CVE-2015-6324

The CVE-2015-6324 issue affects Cisco ASA (Adaptive Security Appliance) DHCPv6 relay. A remote, unauthenticated attacker can exploit improper validation of DHCPv6 packets to cause a denial-of-service and device reload. Affected software versions are ASA 9.0 up to 9.0(4.37), 9.1 up to 9.1(6.6), 9....

CVE-2015-4851

Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015...

CVE-2015-4849

Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the...

Xxe

Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the...

Xxe

Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015...

CVE-2015-4849

Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the...

CVE-2015-4851

Unspecified vulnerability in the Oracle iSupplier Portal component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to XML input. NOTE: the previous information is from the October 2015...

CVE-2015-4849

CVE-2015-4849 corresponds to an XXE injection vulnerability in Oracle E-Business Suite’s Punch-in path. The ERPScan advisory (ERPSCAN-15-029) and related sources indicate: affected product/version is Oracle E‑Business Suite 12.1.3 (likely others); vulnerable component is the Punch‑in servlet at /...

Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability

A vulnerability in the DHCPv6 relay feature of Cisco Adaptive Security Appliance ASA software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation of DHCPv6 packets. Cisco ASA Software is affected by this...

SUSE-SU-2015:1890-1 Security update for openstack-neutron and crowbar-barclamp-neutron

This update provides security fixes and improvements for openstack-neutron and crowbar-barclamp-neutron. crowbar-barclamp-neutron: - Add infoblox support. - Add configurations required to support DHCP relay. - Create 'floating' network as 'flat' provider network. bsc946882 - Fix search for Nova...

This Guy Builds A Thor-Like Hammer that Only He Can Pick Up

If you have watched the most recent Avengers movie, then you would be aware of a scene where all the superheroes Iron Man, War Machine, Hawkeye, and Captain America take turns to lift Thor’s hammer but fail. Someone has an explanation, Why? Inspired by Thor's legendary hammer Mjolnir that is not...

FreeBSD : james -- multiple vulnerabilities (be3069c9-67e7-11e5-9909-002590263bf5)

The Apache James Project reports : This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of...

james -- multiple vulnerabilities

The Apache James Project reports: This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of Jam...

Drupal Camtasia Relay Module Cross-Site Scripting Vulnerability

Drupal is an open source content management framework written in the PHP language. A cross-site scripting vulnerability exists in the Drupal Camtasia Relay Module, which can be exploited by an attacker to execute arbitrary script code in a browser to steal cookie-based authentication credentials...

CVE-2015-5487

Cross-site scripting XSS vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access...

Cross site scripting

Cross-site scripting XSS vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access...