Microsoft Forefront UAG ExcelTable Information Disclosure (MS11-079; CVE-2011-1895)

An information disclosure vulnerability has been reported in Microsoft Forefront Unified Access Gateway UAG. The vulnerability is due to improper validation of user supplied URLs by the UAG server. A remote attacker could trigger this issue by sending a specially crafted HTTP request to an affect...

Microsoft ForeFront ExcelTable Data Cross-Site Scripting (MS11-079)

An information disclosure vulnerability has been reported in Microsoft Forefront Unified Access Gateway UAG server...

Microsoft Forefront Unified Access Gateway 'MicrosoftClient.Jar' Remote Code Execution Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a remote code-execution vulnerability. Successful exploits will allow attackers to execute arbitrary code in the context of the logged-in user. Technologies Affected Microsoft Forefront Unified Access Gateway 2010 Microsoft...

MS11-079: Vulnerabilities in Microsoft Forefront Unified Access Gateway Could Cause Remote Code Execution (2544641)

The version of Forefront Unified Access Gateway UAG running on the remote host has multiple vulnerabilities in the Web Monitor component : - An HTTP response splitting vulnerability in ExcelTable.asp. CVE-2011-1895 - A reflected XSS in ExcelTable.asp. CVE-2011-1896 - A reflected XSS in Default.as...

Microsoft Forefront Unified Access Gateway (CVE-2011-1895) HTTP Response Splitting Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data. Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could ai...

Microsoft Forefront Unified Access Gateway (CVE-2011-1896) Cross-Site Scripting Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a cross-site scripting vulnerability because Web Monitor fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

MS11-079: Vulnerabilities in Microsoft Forefront Unified Access Gateway could cause remote code execution: October 11, 2011

Resolves vulnerabilities in Microsoft Forefront Unified Access Gateway that could cause remote code execution and that was released on October 11, 2011.INTRODUCTIONMicrosoft has released security bulletin MS11-079. To view the complete security bulletin, visit the following Microsoft website: IT...

Microsoft Forefront Unified Access Gateway (CVE-2011-1897) Cross-Site Scripting Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a cross-site scripting vulnerability because Web Monitor fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of...

Microsoft Forefront Unified Access Gateway Null Session Cookie Denial of Service Vulnerability

Description Microsoft Forefront Unified Access Gateway is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the web server of the affected application, denying service to legitimate users. Technologies Affected Microsoft Forefront Unified Access Gateway...

CVE-2011-3288

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

Code injection

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

CVE-2011-3288

CVE-2011-3288 affects Cisco Unified Presence before 8.5(4). The vulnerability arises from improper detection of recursion during XML entity expansion, allowing a remote attacker to craft an XML document with deeply nested entity references to cause memory and CPU exhaustion and potentially crash ...

CVE-2011-3288

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

Microsoft Releases Advance Notification for October Security Bulletin

Microsoft has issued a Security Bulletin Advance Notification indicating that its October release will contain eight bulletins. These bulletins will have the severity ratings of critical and important and will be for Microsoft .NET Framework, Microsoft Silverlight, Microsoft Windows, Internet...

PT-2011-4371 · Cisco · Cisco Unified Presence

Name of the Vulnerable Software and Affected Versions: Cisco Unified Presence versions prior to 8.54 Description: The issue allows remote attackers to cause a denial of service, consuming memory and CPU, and potentially crashing the process. This is achieved by sending a crafted XML document that...

Memory corruption

Memory leak in Cisco IOS 12.4, 15.0, and 15.1, Cisco IOS XE 2.5.x through 3.2.x, and Cisco Unified Communications Manager CUCM 6.x and 7.x before 7.15bsu4, 8.x before 8.51su2, and 8.6 before 8.61 allows remote attackers to cause a denial of service memory consumption and device reload or process...

CVE-2011-2072

Memory leak in Cisco IOS 12.4, 15.0, and 15.1, Cisco IOS XE 2.5.x through 3.2.x, and Cisco Unified Communications Manager CUCM 6.x and 7.x before 7.15bsu4, 8.x before 8.51su2, and 8.6 before 8.61 allows remote attackers to cause a denial of service memory consumption and device reload or process...

Cisco Jabber Extensible Communications Platform / Cisco Unified Presence

Resources exhaustion on XML parsing...

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities Advisory ID: cisco-sa-20110928-sip Revision 1.0 For Public Release 2011 September 28 1600 UTC GMT...

Cisco Security Advisory: Jabber Extensible Communications Platform and Cisco Unified Presence XML Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Jabber Extensible Communications Platform and Cisco Unified Presence XML Denial of Service Vulnerability Advisory ID: cisco-sa-20110928-xcpcupsxml Revision 1.0 For Public Release 2011 September 28 1600 UTC GMT...