Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

CVE-2015-1499

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

Cross site request forgery (csrf)

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

CVE-2015-1499

The CVE-2015-1499 entry concerns the Samsung Security Manager (SSM) ActiveMQ Broker. Affected version: SSM before 1.31. Vulnerability arises in the ActiveMQ Broker where remote attackers can delete arbitrary files via a DELETE request, enabling a denial-of-service condition. Public-source details...

CVE-2015-1499

The ActiveMQ Broker in Samsung Security Manager SSM before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request...

CVE-2014-3365

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

CVE-2014-3365

Multiple cross-site scripting XSS vulnerabilities in Cisco Prime Security Manager PRSM 9.2.1-2 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted input to the 1 Dashboard or 2 Configure Realm page, aka Bug ID CSCuo94808...

CVE-2014-3365

CVE-2014-3365 (Cisco Prime Security Manager) affects PRSM versions up to 9.2(.1-2) and earlier. The vulnerability is a result of improper input validation in the Dashboard and Configure Realm pages, allowing an unauthenticated, remote attacker to inject and execute arbitrary web script or HTML (X...

Cisco Prime Security Manager Cross-Site Scripting Vulnerability

A vulnerability in multiple web interface pages of Cisco Prime Security Manager could allow an unauthenticated, remote attacker to execute cross-site scripting XSS attacks or hijack user sessions. The vulnerability is due to a failure to properly validate user-supplied input in the Dashboard and...

Cisco Prime Security Manager Cross-Site Scripting Vulnerability (CNVD-2015-01125)

Cisco Prime Security Manager is a tool for centralized management of the Cisco ASA 5500-X Series firewalls. A cross-site scripting vulnerability exists in Cisco Prime Security Manager due to the program failing to properly filter user-supplied input. An attacker could exploit this vulnerability t...

Samsung Security Manager ActiveMQ Broker Service DELETE Method Denial of Service Vulnerability

This vulnerability allows remote attackers to delete files of their choosing from systems running vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ActiveMQ Broker service that is installed as pa...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...