IcedTea jnlp security manager bypass

The JNLP SecurityManager in IcedTea IcedTea.so 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security...

Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability Advisory ID: cisco-sa-20101027-cs Revision 1.0 For Public Release 2010 October 27 1600 UTC GMT...

ZDI-10-143: Novell Sentinel Log Manager Multiple Servlet Remote Code Execution Vulnerabilities

ZDI-10-143: Novell Sentinel Log Manager Multiple Servlet Remote Code Execution Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-10-143 August 9, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell Security Manager -- Vulnerability...

Cross site scripting

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when th...

CVE-2010-1871

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when th...

CVE-2010-1871

CVE-2010-1871 affects JBoss Seam 2 (jboss-seam2) as used in Red Hat Linux’s JBoss Enterprise Application Platform 4.3.0. The vulnerability stems from inadequate sanitization of inputs to JBoss Expression Language (EL) expressions, enabling remote code execution via a crafted URL when the Java Sec...

CVE-2010-1871

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when th...

CVE-2010-1871

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when th...

PT-2010-1176 · Red Hat · Jboss Seam 2 +1

Name of the Vulnerable Software and Affected Versions: JBoss Seam 2 versions 2.0 through 2.3 JBoss Enterprise Application Platform version 4.3.0 Description: The issue is related to the improper sanitization of inputs for JBoss Expression Language EL expressions in JBoss Seam 2, which can be...

Seam2: Improper sanitization of parametrized JBoss EL expressions (ACE)

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when th...

Important: Red Hat Security Advisory: jboss-seam2 security update

Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

JBoss Seam 2 Remote Command Execution

JBoss Seam 2 jboss-seam2, as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language EL expressions, which allows remote attackers to execute arbitrary code via a crafted URL. This modules also has been tested...

Outlook Web Access Attachment Access

This trick is mostly useful but can also be used for wrong purposes. Since it is so simple, it’s probably already known for some people. If someone sends you a file through OWA but the file is blocked by a policy, this is what you can do: 1-Install firefox 2-Access your email and attachment with...

Buffer overflow

Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager ASM 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager PSM 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service crash via unknown vectors...

CVE-2009-4420

Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager ASM 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager PSM 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service crash via unknown vectors...

CVE-2009-4420

Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager ASM 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and Protocol Security Manager PSM 9.4.5 through 9.4.7 and 10.0.0 through 10.0.1, allows remote attackers to cause a denial of service crash via unknown vectors...

McAfee Network Security Manager XSS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 SecureWorks Security Advisory SWRX-2009-001 McAfee Network Security Manager Cross-Site Scripting XSS Vulnerability Advisory Information Title: McAfee Network Security Manager Cross-Site Scripting XSS Vulnerability Advisory ID: SWRX-2009-001 Advisory...

CVE-2009-3566

McAfee IntruShield Network Security Manager NSM before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting XSS vulnerability...

McAfee Network Security Manager Login.jsp页面跨站脚本漏洞

BUGTRAQ ID: 37003 CVE ID: CVE-2009-3565 McAfee Network Security Manager是一款功能强大的入侵防护解决方案。 McAfee Network Security Manager没有正确地验证提交给管理控制台Login.jsp页面的iaction和node参数便在动态生成的Web内容中返回给了用户，远程攻击者可以通过跨站脚本攻击在用户的浏览器会话中注入并执行任意HTML或脚本代码。 0 McAfee Network Security Manager 5.1.7.7 厂商补丁： McAfee ------...

McAfee Network Security Manager <5.1.11.8.1 Information Disclosure Vulnerability

No description provided by source. To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage. The following proof of concept uses a cross-site scripting attack to leverage this issue:...