CVE-2015-0577

Cisco AsyncOS ISQ (IronPort Spam Quarantine) XSS: multiple vulnerabilities in the ISQ web page on ESA/SMA due to insufficient input validation, enabling remote attackers to inject arbitrary script/HTML via unspecified parameters. Root cause: input validation gaps in the web page. Impact: cross-si...

Cisco Content Security Management Appliance Telnet Remote Code Execution (cisco-sa-20120126-ironport)

According to its self-reported version, the version of AsyncOS running on the remote Cisco Content Security Management Appliance SMA is affected by a remote code execution vulnerability due to a buffer overflow condition in the telnet component. C Tenable Network Security, Inc. include"compat.inc...

MIRcon 2014 – Day 2 Highlights

MIRcon 2014 It seemed fitting that the last day of MIRcon started with a total lunar eclipse and ended with an inspirational keynote address by renowned astrophysicist Dr. Neil deGrasse Tyson. After an amazing two days of content, MIRcon 2014 is officially in the books! Following are some of the...

AlienVault Releases Intrusion Detection Systems (IDS) Best Practices

Network security practitioners rely heavily on intrusion detection systems IDS to identify malicious activity on their networks by examining network traffic in real time. IDS are available in Network NIDS and Host HIDS forms, as well as for Wireless WIDS. Host IDS is installed via an agent on the...

Bitdefender GravityZone 5.1.5.386 - Multiple Vulnerabilities

Bitdefender GravityZone versions prior to 5.1.11.432 suffer from local file disclosure, insecure service configuration, and missing authentication vulnerabilities. product: Bitdefender GravityZone vulnerable version: =5.1.11.432 impact: critical homepage: http://www.bitdefender.com found:...

AlienVault OSSIM 4.6.1 - Authenticated SQL Injection

No description provided by source. Exploit Title: AlienVault newpolicyform.php SQLi Date: 5/9/2014 Exploit Author: chrisdhebertatgmail.com Vendor Homepage: http://www.alienvault.com/ Software Link: http://www.alienvault.com/free-downloads-services Version: 4.6.1 and below Tested on: Linux CVE : n...

Cyberoam Central Console 2.00.2 - File Include Vulnerability

No description provided by source. Title: ====== Cyberoam Central Console v2.00.2 - File Include Vulnerability Date: ===== 2012-02-08 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=405 VL-ID: ===== 405 Introduction: ============= Cyberoam Central Console CCC appliances...

Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability

No description provided by source. ANATOLIA SECURITY ADVISORY -------------------------------------- ADVISORY INFO + Title: Apache Archiva Cross-site Request Forgery Vulnerability + Advisory URL: http://www.anatoliasecurity.com/adv/as-adv-2010-001.txt + Advisory ID: 2010-001 + Versions: Archiva 1...

McAfee IntruShield Security Management System Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/14167/info McAfee IntruShield Security Management System is susceptible to multiple vulnerabilities. The first two issues are cross-site scripting vulnerabilities in the 'intruvert/jsp/systemHealth/SystemEvent.jsp' script...

CVE-2014-3289

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the web management interface in Cisco AsyncOS on the Email Security Appliance ESA 8.0, Web Security Appliance WSA 8.0 .5 Hot Patch 1 and earlier, and Content Security Management Appliance SMA 8.3 and earlier allows remote attackers to inject arbitrary web...

CVE-2014-3289

CVE-2014-3289 is a reflected XSS vulnerability in Cisco AsyncOS used by ESA, WSA, and SMA. The issue stems from insufficient input validation of the date_range parameter on the web management interface (notably monitor/reports/overview). A remote attacker can inject arbitrary script by tricking a...

Microsoft Internet Explorer CVE-2014-1805 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet explorer ...

Cisco AsyncOS contains a reflected cross-site scripting (XSS) vulnerability

Overview Cisco AsyncOS contains a reflected cross-site scripting XSS vulnerability. Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-3289 Cisco AsyncOS, the underlying OS for the Cisco Email Security Appliance, Web Security Applianc...

CVE-2014-2195

CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA). When Active Directory is enabled, the software does not properly handle group names, enabling a remote attacker to gain role privileges by exploiting group-name similarity (Bug I...

Skybox Security 6.3.x - 6.4.x - Multiple Information Disclosure

Exploit for hardware platform in category web applications Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14,...

AlienVault Unified Security Management "date_from" SQL注入漏洞

AlienVault Unified Security Management是一款安全管理平台。 由于通过"datefrom"参数传递到ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php的输入在被用于SQL查询前没有正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 AlienVault Unified Security Management USM 4.x 目前没有详细解决方案： http://www.alienvault.com/products...

HP Security Management System code execution

No description provided...

[security bulletin] HPSBHF02965 rev.1 - HP Security Management System, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04156626 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04156626 Version: 1 HPSBHF02965 rev....

Cisco AsyncOS for Content Security Management Appliances Software Remote Code Execution (CSCug80118)

According to its self-reported version, the version of Cisco Content Security Management Appliance running on the remote host is affected by a remote code execution vulnerability due to a flaw in Cisco AsyncOS. An authenticated attacker could potentially exploit this vulnerability to execute...