SolarWinds Firewall Security Manager userlogin.jsp Policy Bypass (CVE-2015-2284)

A policy bypass vulnerability exists in SolarWinds Firewall Security Manager. The vulnerability is due to a design weakness in the userlogin.jsp page which sets the "username" session value to a user supplied value prior to authentication. A remote unauthenticated attacker could exploit this...

IBM Security Identity Manager Information Disclosure Vulnerability (CNVD-2015-01982)

IBM Security Identity Manager is part of the IBM Security Systems portfolio of products that help organizations drive effective identity management and control across the enterprise, reducing the risk of identity fraud and improving regulatory compliance. An information disclosure vulnerability...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

Session fixation

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

CVE-2015-2284

CVE-2015-2284 affects SolarWinds Firewall Security Manager (FSM) prior to version 6.6.5 HotFix1, with a vulnerability in userlogin.jsp that enables an unauthenticated remote attacker to gain privileges and execute arbitrary code via a client session handling flaw. The linked sources indicate mult...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

Cisco Prime Security Manager Network Time Protocol Daemon (ntpd) Multiple Vulnerabilities (cisco-sa-20141222-ntpd)

According to its self-reported version number, the version of Cisco Prime Security Manager running on the remote host is prior to 9.3.3.2. It is, therefore, affected by multiple vulnerabilities in the bundled NTP libraries : - A security weakness exists due to the configauth function improperly...

Java JMX Server Insecure Configuration Java Code Execution

This module takes advantage a Java JMX interface insecure configuration, which would allow loading classes from any remote HTTP URL. JMX interfaces with authentication disabled com.sun.management.jmxremote.authenticate=false should be vulnerable, while interfaces with authentication enabled will ...

SolarWinds Firewall Security Manager Arbitrary Code Execution Vulnerability

SolarWinds Firewall Security Manager FSM is a suite of multi-vendor firewall security and change management software from SolarWinds USA. A security vulnerability exists in the installation process of SolarWinds FSM. A remote attacker could exploit the vulnerability to execute arbitrary code...

HP ArcSight Enterprise Security Manager and Logger security vulnerabilities

No description provided...

CVE-2014-7885

HP ArcSight Enterprise Security Manager (ESM) prior to 6.8c is affected by multiple remote vulnerabilities (CVE-2014-7885). The Nessus entry cites XSS due to failure to validate tooltip input and CSRF allowing changes to rules or resources via a crafted link; affected versions include ESM before ...

SolarWinds Firewall Security Manager userlogin.jsp Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Firewall Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of client sessions. The issue lies in the ability to...

IBM SDK Java Technology Information Disclosure Vulnerability

IBM SDK Java Technology is a Java Standard Development Kit SDK from IBM. An information disclosure vulnerability exists in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10,7R1 before SR2-FP10 that could allow a remote attacker to obtai...

CVE-2014-8891

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

Security feature bypass

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

CVE-2014-8892

CVE-2014-8892 affects IBM SDK/JVM used by Tivoli Storage Productivity Center (IBM Java Technology Edition). The IBM security bulletin describes the vulnerability as a bypass of permission checks under a security manager, potentially allowing untrusted code to view sensitive information. Remediati...

CVE-2014-8891

CVE-2014-8891 affects IBM SDK, Java Technology Edition (IBM JRE) under multiple releases: 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10. The vulnerability allows remote attackers to escape the Java sandbox and execute arbitrary code through...

F5 Networks BIG-IP : ASM < 11.6.0 Response Body XSS

The F5 Networks Application Security Manager ASM running on the remote device is prior to version 11.6.0. It is, therefore, affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to the 'Response Body' field when a new user account is being created. A...