Multiple Cross-Site Scripting Vulnerabilities in Cisco Security Manager

Cisco Security Manager centralizes the task of configuring policies and controls for Cisco security deployments, enabling efficient management of enterprise-level security. Cisco Security Manager has multiple cross-site scripting vulnerabilities due to the program failing to properly filter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and...

CVE-2015-0594

Multiple cross-site scripting XSS vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and...

CVE-2015-0594

Cisco Common Services (used by Cisco Prime LAN Management Solution and Cisco Security Manager) contains cross-site scripting (XSS) vulnerabilities in the help pages. The root cause is insufficient input validation of some parameters used by the help page system, allowing remote attackers to trigg...

SOL16081 - BIG-IP ASM cross-site scripting (XSS) vulnerability CVE-2015-1050

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6.0 allows an authenticated user to inject arbitrary web script or HTML via the Response Body field. CVE-2015-1050...

JDK: Privilege escalation issue

Unspecified vulnerability in the IBM Java Virtual Machine, as used in IBM WebSphere Real Time 3 before Service Refresh 7 FP1 and other products, allows remote attackers to gain privileges by leveraging the ability to execute code in the context of a security manager...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

Samsung Security Manager Security Bypass Vulnerability

Samsung Security Manager is a centralized management platform for video recording devices from Samsung in South Korea, which supports site group management, displaying a list of registered devices, and enabling playback of specified video borders through mouse drag-and-drop or double-click...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

CVE-2015-1499

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

Cross site request forgery (csrf)

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

CVE-2015-1499

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

CVE-2015-1499

The CVE-2015-1499 entry concerns the Samsung Security Manager (SSM) ActiveMQ Broker. Affected version: SSM before 1.31. Vulnerability arises in the ActiveMQ Broker where remote attackers can delete arbitrary files via a DELETE request, enabling a denial-of-service condition. Public-source details...

CVE-2014-3365

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

CVE-2014-3365

CVE-2014-3365 (Cisco Prime Security Manager) affects PRSM versions up to 9.2(.1-2) and earlier. The vulnerability is a result of improper input validation in the Dashboard and Configure Realm pages, allowing an unauthenticated, remote attacker to inject and execute arbitrary web script or HTML (X...