McAfee Cloud Single Sign On目录遍历漏洞

CVE ID: CVE-2014-2536 McAfee Cloud Single Sign On是一款基于云的单点登录解决方案。 McAfee Cloud Single Sign On不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交特制的目录遍历请求，读取任意文件内容。 0 McAfee Cloud Single Sign On formerly McAfee Cloud Identity Manager 4.x McAfee Cloud Single Sign On 4.0.1已经修复该漏洞，建议用户下载更新：...

PT-2014-4768

Name of the Vulnerable Software and Affected Versions McAfee Cloud Identity Manager versions 3.0 through 3.5.1 McAfee Cloud Single Sign On MCSSO versions prior to 4.0.1 Intel Expressway Cloud Access 360-SSO versions 2.1 through 2.5 Description A directory traversal issue allows remote authenticat...

CVE-2014-2536: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On MCSSO before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator passwo...

Safari User-Assisted Download and Run Attack

This module abuses some Safari functionality to force the download of a zipped .app OSX application containing our payload. The app is then invoked using a custom URL scheme. At this point, the user is presented with Gatekeeper's prompt: "APPNAME" is an application downloaded from the internet. A...

RelateIQ: open redirect

go to https://www.relateiq.com/sign-up 2. Fill the form and click on signup free button. 3. Intercept the request using tamper data and change the 'retURL' parameter to any value like https://google.com any evil url and submit the request. 4. The web app redirect to any evil website...

PHP 'ext/gd/gd.c' gdImageCrop整数符号错误漏洞

CVE ID:CVE-2013-7328 PHP是一种HTML内嵌式的语言。 PHP 'ext/gd/gd.c' gdImageCrop函数存在多个整数符号错误，允许远程攻击者通过调用x或Y维度为负值的imagecrop函数，可使应用程序崩溃或获取敏感信息。 0 PHP 5.5.x PHP 5.5.9已经修复该漏洞，建议用户下载更新： http://php.net...

Yahoo Mail hacked; Change your account password immediately

A really bad year for the world's second-largest email service provider, Yahoo Mail! The company announced today, 'we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts', user names and passwords of its email customers have been stolen and are used to access multip...

Oracle Access Manager (October 2013 CPU)

The version of Oracle Access Manager installed on the remote host is affected by an unspecified flaw in the Authentication Engine subcomponent. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid72214;...

PT-2014-04: Single Sign-On Vulnerability in Nixu Namesurfer

The specialists of the Positive Research center have detected a Single Sign-On vulnerability in Nixu Namesurfer. All services used by the Nixu Namesurfer software PostgreSQL, Apache use the same user account to operate. Therefore, a weakness in one of the services will affect all of them. For...

MGASA-2013-0383 Updated chromium-browser-stable fixes multiple vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities: Pinkie Pie discovered multiple memory corruption issues CVE-2013-6632. Andrey Labunets discovered that the wrong URL was used during validation in the one-click sign on helper CVE-2013-6634. cloudfuzzer discovered use-after-fr...

CVE-2013-5420: Undefined Security Weakness

The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote authenticated users to read log files by leveraging helpdesk privileges for a direct request...

PT-2013-5532

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO versions 8.2 before Ifix 6 Description The issue allows remote authenticated users with helpdesk privileges to read log files by making a direct request. Recommendations For I...

CVE-2013-6745

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

Cross site scripting

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

CVE-2013-5421: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

CVE-2013-6745: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

PT-2013-6104

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO version 8.2 before Ifix 6 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via crafted input to ...

PT-2013-5533

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO version 8.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via crafted input to a dynamic web form...

HP Integrated Lights-Out (iLO) Remote Unauthorized Access Vulnerability

HP Integrated Lights-Out iLO is prone to an unauthorized access vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

iLO 3 < 1.57 / iLO 4 < 1.22 Unspecified Arbitrary Code Execution

According to its version number and single sign-on settings, the remote HP Integrated Lights-Out iLO server is affected by an arbitrary code execution vulnerability in its web interface. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...