Server side request forgery (ssrf)

The gadgets-integration API in Cisco Finesse 8.51 through 8.55, 8.61, 9.01, 9.02, 9.11, 9.11SU1, 9.11SU1.1, 9.11ES1 through 9.11ES5, 10.01, 10.01SU1, 10.01SU1.1, 10.51, 10.51ES1 through 10.51ES4, 10.51SU1, 10.51SU1.1, 10.51SU1.7, 10.61, 10.61SU1, 10.61SU2, and 11.01 allows remote attackers to...

CVE-2016-1373

The gadgets-integration API in Cisco Finesse 8.51 through 8.55, 8.61, 9.01, 9.02, 9.11, 9.11SU1, 9.11SU1.1, 9.11ES1 through 9.11ES5, 10.01, 10.01SU1, 10.01SU1.1, 10.51, 10.51ES1 through 10.51ES4, 10.51SU1, 10.51SU1.1, 10.51SU1.7, 10.61, 10.61SU1, 10.61SU2, and 11.01 allows remote attackers to...

CVE-2016-3718

A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTPS requests or opening...

Mail.ru: SSRF на element.mail.ru

Server Side Request Forgery in out-of-csope partner project outside of company's network...

Damn Vulnerable Web Services: DVWS

Damn Vulnerable Web Services is a vulnerable testing environment that can be used to learn real world web service vulnerabilities. The aim of this project is to aid security professionals in testing their skills and tools in a legal environment. This application is designed to understand the...

Yeager CMS 1.2.1 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Yeager CMS vulnerable version: 1.2.1 fixed version: 1.3 CVE number: CVE-2015-7567, CVE-2015-7568, CVE-2015-7569, CVE-2015-7570 ,...

[SECURITY] [DSA 3472-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3472-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 08, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3472-1 (wordpress - security update)

Two vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2221 Shailesh Suthar discovered an open redirection vulnerability. CVE-2016-2222 Ronni Skansing discovered a server-side request...

DSA-3472-1 wordpress - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3472-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0044 Updated cakephp package fixes security vulnerability

CakePHP, an open-source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...

WordPress < 4.4.2 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.4.2. It is, therefore, affected by the following vulnerabilities : - A cross-site redirection vulnerability exists due to a failure by the application to validate certain input...

WordPress Update Fixes SSRF, Open Redirect Vulnerability

Developers at WordPress are encouraging users to upgrade to the latest version, 4.4.2, in order to resolve a handful of bugs and vulnerabilities in the content management system. The update pushed out on Tuesday addresses two main issues. Until yesterday an attacker could have potentially carried...

VMware vCenter Multiple Vulnerabilities (VMSA-2015-0008)

The VMware vCenter Server installed on the remote host is affected by the following vulnerabilities : - An XML external entity XXE injection flaw exists in Flex BlazeDS in the file flex-messaging-core.jar due to an incorrectly configured XML parser accepting XML external entities from untrusted...

Server side request forgery (ssrf)

Cisco Unified Computing System UCS Central software 1.30.1 allows remote attackers to conduct server-side request forgery SSRF attacks via a crafted request, aka Bug ID CSCux33575...

Adobe ColdFusion Multiple Vulnerabilities (APSB15-29) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by multiple vulnerabilities : - Multiple cross-site scripting XSS vulnerabilities exist due to a failure to validate input before returning it to the user. A remote attacker can exploit these to inject arbitrary script...

Server side request forgery (ssrf)

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

CVE-2015-5255

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

CVE-2015-5255

Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to...

Adobe Issues HotFix For ColdFusion

Adobe this afternoon released hotfixes and security updates for three of its products that patch a handful of vulnerabilities, none of which are being publicly exploited. The most serious vulnerabilities were in ColdFusion, Adobe’s web application development platform. The hotfix affects ColdFusi...