JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

Fixed in Apache Tomcat 7.0.59

Note: The issue below was fixed in Apache Tomcat 7.0.58 but the release vote for the 7.0.58 release candidate did not pass. Therefore, although users must download 7.0.59 to obtain a version that includes a fix for this issue, versions 7.0.58 is not included in the list of affected versions...

F5 BIG-IP Application Security Manager Cross-Site Scripting Vulnerability

The F5 BIG-IP Application Security Manager ASM is a BIG-IP application security manager from F5 USA that provides users with application delivery security solutions, as well as secure remote access, protection of email, and simplified Web access control, while enhancing network and application...

Fixed in Apache Tomcat 8.0.17

Note: The issue below was fixed in Apache Tomcat 8.0.16 but the release vote for the 8.0.16 release candidate did not pass. Therefore, although users must download 8.0.17 to obtain a version that includes a fix for this issue, version 8.0.16 is not included in the list of affected versions...

Cross site scripting

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account...

CVE-2015-1050

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account...

F5 BIG-IP Application Security Manager crossite scripting

self-XSS...

F5 BIG-IP Application Security Manager (ASM) XSS

Edit: Corrected the date in the timeline from 01/12/14 to 01/12/15. Details ======= Product: F5 BIG-IP Application Security Manager ASM Vulnerability: Cross Site Scripting Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Likely 11.4.x-11.5.x...

ManageEngine-5.5

The SQL injection is possible on the "Advanced Search", the input is not validated correctly. To make it even worse, the search can be accessed without any authentication. Security Manager Plus also has to run as root or SYSTEM user, which makes a remote shell with root/SYSTEM privileges...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse Service Works 6.0.0 security update

Red Hat JBoss Fuse Service Works 6.0.0 roll up patch 3, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base score...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

jboss-as-server: Unchecked access to MSC Service Registry under JSM

In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container MSC service registry without any permission checks. This could allow malicious deployments to modify the internal state of the...

CVE-2014-3364

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Prime Security Manager aka PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via a 1 Access Policies or 2 Device Summary Dashboard parameter, aka Bug ID CSCuq80661...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Prime Security Manager aka PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via a 1 Access Policies or 2 Device Summary Dashboard parameter, aka Bug ID CSCuq80661...

CVE-2014-3364

Multiple cross-site scripting XSS vulnerabilities in the web framework in Cisco Prime Security Manager aka PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via a 1 Access Policies or 2 Device Summary Dashboard parameter, aka Bug ID CSCuq80661...

CVE-2014-3364

Cisco Prime Security Manager (PRSM) web framework contains XSS vulnerabilities (CVE-2014-3364) in versions 9.2.1-2 and earlier. The underlying issue is insufficient input validation on parameters in the Access Policies and Device Summary Dashboard pages, enabling remote attackers to inject arbitr...

Cisco Prime Security Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Prime Security Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of several...

Cross site scripting

Cross-site scripting XSS vulnerability in the tree view pltree.php feature in Application Security Manager ASM in F5 BIG-IP 11.3.0 allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation...