3255 matches found
OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)
It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...
OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)
A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...
Abus Security Center 'FTP' HTML Injection Vulnerability
Abuse is a popular video game. An HTML injection vulnerability exists in Abus Security Center due to the program failing to adequately clean up user input. An attacker could exploit the vulnerability to execute arbitrary script code in the context of an affected browser to steal a user's...
Tomcat: CGI sets environmental variable based on user supplied Proxy request header
It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...
CVE-2016-6416
The FTP service in Cisco AsyncOS on Email Security Appliance ESA devices 9.6.0-000 through 9.9.6-026, Web Security Appliance WSA devices 9.0.0-162 through 9.5.0-444, and Content Security Management Appliance SMA devices allows remote attackers to cause a denial of service via a flood of FTP...
Cisco AsyncOS File Transfer Protocol Denial of Service Vulnerability
Cisco AsyncOS on Email Security Appliance ESA and so on are products of Cisco Corporation.Cisco ESA is a set of email security appliances.Cisco Content Security Management Appliance SMA is a set of content security management appliances.Cisco Web Security Appliance WSA is a set of web security...
Cisco Content Security Management Appliance File Transfer Protocol Denial of Service Vulnerability (cisco-sa-20160928-aos)
A vulnerability in the local File Transfer Protocol FTP service on the Cisco AsyncOS for Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...
Cisco AsyncOS File Transfer Protocol Denial of Service Vulnerability
A vulnerability in the local File Transfer Protocol FTP service on the Cisco AsyncOS for Email Security Appliance ESA, Web Security Appliance WSA, and Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The...
CVE-2016-6839
CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...
HTTP Information Disclosure Vulnerability
HTTP HyperText Transfer Protocol is one of the most widely used network protocols on the Internet. HTTP was designed to provide a means of publishing and receiving HTML pages, and the resources requested through the HTTP protocol are identified by Uniform Resource Identifiers URIs.HTTP/2 is one o...
Siemens SIPROTEC 4/SIPROTEC Compact Denial of Service Vulnerability
SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of centralized protection, control and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 4, SIPROTEC Compact devices, versions prior to EN100 Ethernet 4.29. A remot...
UBUNTU-CVE-2016-5137
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs,...
The vulnerability of Fonality’s corporate telephony software allows a perpetrator to gain access to protected information.
The vulnerability of the Fonality corporate telephony software relates to the rigid encoding of registration data for FTP login records. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected information via FTP or SSH connections...
The vulnerability of the microprogramming software of Schneider Electric’s Modicon Quantum programmable logic controllers allows a malicious individual to gain unauthorized access to the device.
The microprogrammed software of the 140NOE77111 module of Schneider Electric’s Modicon Quantum controller contains numerous login pairs—passwords that are pre-set by default. This allows any user who has access to the device via FTP protocol to gain authorized access to the device...
The vulnerability of the Dnsmasq software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.
Overfilling the buffer in dynamic memory in the tftprequest function in tftp.c in dnsmasq when using --enable-tftp allows malicious actors operating remotely to execute arbitrary code by using a long filename in the TFTP packet; for example, in a read request RRQ...
The vulnerability of the Cisco Wireless LAN Controller 4100 software allows for circumventing access restrictions.
Vulnerability exists in Cisco Wireless LAN Controller WLC devices due to the widespread use of the Aironet IOS software. This leads to a state where the controller acts as an administrative HTTP server. Exploiting this vulnerability allows malicious actors to bypass access restrictions by...
The vulnerability of Cisco Nexus 7000 software allows a malicious actor to trigger buffer overflows.
The buffer overflow in the implementation of the Smart Call Home function in Cisco NX-OS for Cisco Unified Computing System UCS switches and Nexus devices, as well as in Cisco CG-OS for Cisco Connected Grid series 1000 routers, allows remote SMTP servers to execute arbitrary code using specially...
The vulnerability of the Cisco IronPort Email Security Appliance allows a malicious individual to execute arbitrary code.
The vulnerability in the SLBL service a check for reliable/locked users in Cisco AsyncOS, used by Email Security Appliances and Content Security Management Appliances, allows remote users who have passed authentication to execute arbitrary code with superuser privileges, by downloading a modified...
CVE-2016-1440
The proxy process on Cisco Web Security Appliance WSA devices through 9.1.0-070 allows remote attackers to cause a denial of service CPU consumption by establishing an FTP session and then improperly terminating the control connection after a file transfer, aka Bug ID CSCuy43468...