DoD DIACAP transition to RMF approved

Welcome DIARMF! This has been a long time coming. From DITSCAP to DIACAP and now to DIARMF the Department of Defense approved the transition to a Risk Management Framework RMF approach developed by NIST on March 12. What does this mean for Information Systems and Platform Information Technology...

AlienVault Unified Security Management "date_from" SQL注入漏洞

AlienVault Unified Security Management是一款安全管理平台。 由于通过"datefrom"参数传递到ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php的输入在被用于SQL查询前没有正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 AlienVault Unified Security Management USM 4.x 目前没有详细解决方案： http://www.alienvault.com/products...

Cisco Unity Connection Web Inbox跨站脚本漏洞

CVE ID:CVE-2014-2125 Cisco Unity Connection是运行在Linux-based Cisco Unified Communications操作系统上的功能强大的语音消息通讯平台。 由于某些关于网页收件箱的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML 和脚本代码。 0 Cisco Unity Connection 8.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

HP Unified Functional Testing任意代码执行漏洞

BUGTRAQ ID: 66197 CVECAN ID: CVE-2013-6210 HP Unified Functional Testing是一款自动化软件测试解决方案。 HP Unified Functional Testing 12.0之前版本在实现上存在安全漏洞，这可使远程攻击者利用此漏洞执行任意代码。 0 HP Unified Functional Testing 12.0 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

[security bulletin] HPSBMU02967 rev.2 - HP Unified Functional Testing Running on Windows, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iNote: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04122007 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04122007 Version: 2 HPSBMU02967 rev...

HP Unified Functional Testing < 12.0 Remote Code Execution (HPSBMU02967)

The remote Windows host has a version of HP Unified Functional Testing prior to 12.0. It is, therefore, affected by an unspecified remote code execution vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid73094; scriptversion"1.5"; scriptcvsdate"Date:...

HP Unified Functional Testing远程代码执行漏洞

Bugtraq ID:66197 CVE ID:CVE-2013-6210 HP Unified Functional Testing是一款惠普推出高级现代应用测试解决方案。 HP Unified Functional Testing存在一个未明安全漏洞，允许远程攻击者利用漏洞执行任意代码。 0 HP Unified Functional Testing HP Unified Functional Testing 12.0已经修复该漏洞，建议用户下载更新：...

CVE-2013-6210

Unspecified vulnerability in HP Unified Functional Testing before 12.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1932...

CVE-2013-6210

Unspecified vulnerability in HP Unified Functional Testing before 12.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1932...

CVE-2013-6210

HP Unified Functional Testing (UFT) versions prior to 12.0 are affected by a remote code execution vulnerability (CVE-2013-6210). The root cause is a flaw in the ExGrid SaveXML path that relies on the Exontrol.Grid ActiveX control, where cell contents are not validated before being written to a f...

Automatic access added to newly added bitbucket account without notificiation

Steps to replicate: Add a new bitbucket account to your JIRA OnDemand instance via the DVCS connector. Click on the cog to the right of your new account and view 'configure automatic access' Result: Automatic access will be set up and membership to the 'developers' group will be granted Expected...

Automatic access added to newly added bitbucket account without notificiation

Steps to replicate: Add a new bitbucket account to your JIRA OnDemand instance via the DVCS connector. Click on the cog to the right of your new account and view 'configure automatic access' Result: Automatic access will be set up and membership to the 'developers' group will be granted Expected...

Cisco Unified Communications Domain Manager多个跨站脚本漏洞

Bugtraq ID:65869 CVE ID:CVE-2014-2104 Cisco Unified Communications Manager是思科统一通信解决方案中强大的呼叫处理组件。 Cisco Unified Communications Manager WEB接口BVSM页不正确校验多个参数数据，允许远程攻击者构建恶意URI，诱使用户解析，当恶意数据被查看时可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 Cisco Unified Communications Domain Manager 目前没有详细解决方案提供： http://www.cisco.com...

CVE-2014-2104

Multiple cross-site scripting XSS vulnerabilities in the Business Voice Services Manager BVSM page in Cisco Unified Communications Domain Manager 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Business Voice Services Manager BVSM page in Cisco Unified Communications Domain Manager 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and...

CVE-2014-2104

Multiple cross-site scripting XSS vulnerabilities in the Business Voice Services Manager BVSM page in Cisco Unified Communications Domain Manager 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and...

CVE-2014-2104

Multiple cross-site scripting XSS vulnerabilities in the Business Voice Services Manager BVSM page in Cisco Unified Communications Domain Manager 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCum78536, CSCum78526, CSCum69809, and...

CVE-2014-2104

Cisco Unified Communications Domain Manager BVSM page (in 9.0(.1)) contains multiple XSS flaws due to insufficient input validation of BVSM parameters. Exploitation allows remote attackers to craft malicious links/URIs to inject script or HTML via unspecified parameters, potentially compromising ...

Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface on the affected system. The vulnerability is due to insufficient input validation of...

Cisco Unified Contact Center Express Serviceability Page CSRF Vulnerability

A vulnerability in the Cisco Unified Serviceability component of Cisco Unified Contact Center Express Cisco Unified CCX could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could...