1435 matches found
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...
Microsys Promotic PmBase64Decode Buffer Overflow (CVE-2014-9205)
A stack-based buffer overflow vulnerability exists in Microsys's Promotic. The vulnerability is due to an insufficient boundary check on user-supplied data in the PmBase64Decode function. A remote, unauthenticated attacker can exploit this vulnerability by supplying a maliciously crafted base64...
Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability
A vulnerability in the HTML help system of Cisco Wireless LAN Controller WLC devices could allow an unauthenticated, remote attacker conduct cross-site scripting attacks. An unauthenticated, remote attacker who can convince a user of an affected system to follow a malicious link or visit an...
SolarWinds Server and Application Monitor loadExtensionFactory Stack Buffer Overflow (CVE-2015-1500)
A stack buffer overflow vulnerability exists in SolarWinds Server and Application Monitor. The vulnerability is due to insufficient validation in loadExtensionFactory method of a 'factory' object. A remote unauthenticated attacker can exploit the vulnerability by enticing a target user to visit a...
SolarWinds Server and Application Monitor loadExtensionFactory Code Execution (CVE-2015-1501)
A code execution vulnerability exists in SolarWind Server and Application Monitor. A remote unauthenticated attacker can exploit the vulnerability by enticing a target user to visit a malicious website. Successful exploitation could allow arbitrary code execution within security context of the...
Schneider Electric Pelco DS-NVs Rvctl.RVControl Buffer Overflow (CVE-2015-0982)
A buffer overflow vulnerability exists in Schneider Electric Pelco DS-NV Software package. The vulnerability is due to insufficient input validation on a user-supplied input in the SetText method before it is copied into a fixed length buffer on stack. A remote unauthenticated attacker can exploi...
Microsoft Excel Cell Length Buffer Overflow (MS04-033) - Ver2 (CVE-2004-0846)
Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available in several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...
Mozilla Firefox Proxy Prototype Remote Code Execution (CVE-2014-8636)
A remote code execution vulnerability has been detected in Mozilla Firefox. A remote attacker may exploit this vulnerability by enticing users to open a specially crafted web-page. Successful exploitation would allow an attacker to execute arbitrary code in the user's security context...
MS15-022: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3038999)
The remote Windows host has a version of Microsoft Office, Office Compatibility Pack, Microsoft Word Viewer, Microsoft Excel Viewer, SharePoint Server, or Microsoft Office Web Apps that is affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist due to...
Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability
A vulnerability in Cisco Unified Web Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to a lack of input sanitization of the Cisco Unified Web...
CVE-2014-5352
The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...
Double free
The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...
CVE-2014-5352
The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...
CVE-2014-5352
Summary: CVE-2014-5352 affects MIT Kerberos libgssapi_krb5 (krb5) where gss_process_context_token can mishandle security-context handles, enabling remote authenticated users to cause denial of service (use-after-free/double-free) or potentially execute code via crafted GSSAPI traffic (demonstrate...
CVE-2014-5352
The krb5gssprocesscontexttoken function in lib/gssapi/krb5/processcontexttoken.c in the libgssapikrb5 library in MIT Kerberos 5 aka krb5 through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to...
WordPress WooCommerce 2.2.10 Cross Site Scripting
==================================================== Product: WooCommerce WordPress plugin Vendor: WooThemes Tested Version: 2.2.10 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium CVSSv2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Solution Status: Solved in version 2.2.11...
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...
Security: Wrong security context loaded when using SAML2 STS Login Module
It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...