JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

JDK: unspecified full Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

JDK: unspecified partial Java sandbox bypass fixed in Feb 2015 update

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via...

PT-2015-4111

Name of the Vulnerable Software and Affected Versions IBM SDK, Java Technology Edition versions 5.0 before SR16-FP9 IBM SDK, Java Technology Edition versions 6 before SR16-FP3 IBM SDK, Java Technology Edition versions 6R1 before SR8-FP3 IBM SDK, Java Technology Edition versions 7 before SR8-FP10...

PT-2015-4110

Name of the Vulnerable Software and Affected Versions IBM SDK, Java Technology Edition versions 5.0 before SR16-FP9 IBM SDK, Java Technology Edition versions 6 before SR16-FP3 IBM SDK, Java Technology Edition versions 6R1 before SR8-FP3 IBM SDK, Java Technology Edition versions 7 before SR8-FP10...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

Fixed in Apache Tomcat 7.0.59

Note: The issue below was fixed in Apache Tomcat 7.0.58 but the release vote for the 7.0.58 release candidate did not pass. Therefore, although users must download 7.0.59 to obtain a version that includes a fix for this issue, versions 7.0.58 is not included in the list of affected versions...

F5 BIG-IP Application Security Manager Cross-Site Scripting Vulnerability

The F5 BIG-IP Application Security Manager ASM is a BIG-IP application security manager from F5 USA that provides users with application delivery security solutions, as well as secure remote access, protection of email, and simplified Web access control, while enhancing network and application...

Fixed in Apache Tomcat 8.0.17

Note: The issue below was fixed in Apache Tomcat 8.0.16 but the release vote for the 8.0.16 release candidate did not pass. Therefore, although users must download 8.0.17 to obtain a version that includes a fix for this issue, version 8.0.16 is not included in the list of affected versions...

Cross site scripting

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account...

CVE-2015-1050

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account...

CVE-2015-1050: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in F5 BIG-IP Application Security Manager ASM before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account...

PT-2015-5037

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Application Security Manager ASM versions prior to 11.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account. This...

F5 BIG-IP Application Security Manager crossite scripting

self-XSS...

F5 BIG-IP Application Security Manager (ASM) XSS

Edit: Corrected the date in the timeline from 01/12/14 to 01/12/15. Details ======= Product: F5 BIG-IP Application Security Manager ASM Vulnerability: Cross Site Scripting Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Confirmed 11.4.0, 11.4.1. Likely 11.4.x-11.5.x...

ManageEngine-5.5

The SQL injection is possible on the "Advanced Search", the input is not validated correctly. To make it even worse, the search can be accessed without any authentication. Security Manager Plus also has to run as root or SYSTEM user, which makes a remote shell with root/SYSTEM privileges...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...