Slack: Source code leakage through GIT web access at host '52.91.137.42'

@d0znpp alerted us to the public availability of Git files on a QA server. This lead to the access to files which should have been restricted. We have enforced proper access control, and Slack awarded @d0znpp a $1,500 bounty for bringing the issue to our attention! Thank you!...

CVE-2016-0028

CVE-2016-0028 affects Microsoft Exchange Server (OWA) and involves an information disclosure flaw in the Outlook Web Access interface. The root cause is insufficient restriction on loading IMG elements, which can allow remote attackers to track users via specially crafted HTML emails. The affecte...

CVE-2016-0028

Outlook Web Access OWA in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka...

MS16-079: Security Update for Microsoft Exchange Server (3160339)

The remote Microsoft Exchange Server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple stack buffer overflow conditions exist in the Oracle Outside In subcomponent due to improper validation of user-supplied input. An unauthenticated, remote attacke...

MS16-079: Description of the security update for Exchange Server 2016 and Exchange Server 2013: June 14, 2016

None None...

IBM Security Access Manager for Web Encryption Protection Mechanism Compromise Vulnerability

IBM Security Access Manager ISAM for Web formerly known as IBM Tivoli Access Manager for e-business is a suite of IBM products for user authentication, authorization, and Web single sign-on solutions that provide user access management and Web application protection Functions. A security...

CVE-2015-5010

IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2016-1984

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier for remote attackers to obtain access via a 1 SSH or 2 HTTP session, a different vulnerability than CVE-2015-8362...

The vulnerability of Microsoft Exchange Server servers allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Outlook Web Access OWA component of the Microsoft Exchange Server email server exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially...

The vulnerability of Microsoft Exchange Server servers allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Outlook Web Access OWA component of the Microsoft Exchange Server email server exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially...

The vulnerability of Microsoft Exchange Server servers allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the Outlook Web Access OWA component of the Microsoft Exchange Server email server exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially...

NetApp Data ONTAP Information Disclosure Vulnerability

NetApp Data ONTAP is a set of storage operating system from American NetApp. The system supports the enhancement of the user's enterprise application performance and improve the flexibility of the data center and so on. A security vulnerability exists in NetApp Data ONTAP versions prior to 8.2.4P...

CVE-2016-0032

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."...

CVE-2016-0031

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029...

CVE-2016-0031

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029...

CVE-2016-0030

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."...

CVE-2016-0029

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031...

CVE-2016-0029

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029...

Cross site scripting

Cross-site scripting XSS vulnerability in Outlook Web Access OWA in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."...