PT-2012-3928

Name of the Vulnerable Software and Affected Versions EMC ApplicationXtender Desktop versions prior to 6.5 SP2 EMC ApplicationXtender Web Access .NET versions prior to 6.5 SP2 Description The issue allows remote attackers to upload files to any location and possibly execute arbitrary code via...

CVE-2012-2289: Undefined Security Weakness

EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files to any location, and possibly execute arbitrary code, via unspecified vectors...

PT-2012-3517

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Remote code execution issues exist due to the WebReady Document Viewing feature. This could allow code execution as Local System if a user views a specially crafted file...

IBM Lotus iNotes Upload模块ActiveX控件缓冲区溢出漏洞

BUGTRAQ ID: 53879 CVE ID: CVE-2012-2175 Lotus iNotes之前被称为Lotus Domino Web Access，是Lotus Domino服务器基于web的消息和协作界面。 IBM Lotus iNotes 8.5.3 FP2之前版本dwa85W.dll内的某些ActiveX控件中的AttachmentTimes方法在实现上存在缓冲区溢出漏洞，通过较长的参数可允许远程攻击者执行任意代码。 0 IBM Lotus iNotes 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

New VPN Hunter Service Scans Domains For Remote-Access Systems

If there’s one thing attackers love, it’s readily accessible remote-connection services running on a target company’s network. Once an attacker knows that an organization is running a specific kind of VPN or has RDP enabled on a bunch of machines, he can then start looking for known vulnerabiliti...

2012 Most Vulnerable Cities At Risk Of Cyber Crime

2012 Most Vulnerable Cities At Risk Of Cyber Crime Norton's study showed the city was one of the ten worst for hacking. Each city was ranked by the prevalence of PCs and smartphones in addition to social media use with risk factors like unsecured Wi-Fi hotspots and malware attempts. Manchester wa...

FreePBX Credential Disclosure

Have freePBX running on a public IP, and don’t have the latest version? It may be vulnerable. If you have an asterisk phone server running on a public IP, using the freePBX web GUI, and don’t have one of the latest releases it may be vulnerable. Its very common to have freePBX on an Internet rout...

Microsoft Outlook Web Access会话重放安全限制绕过漏洞

BUGTRAQ ID: 50361 Outlook Web Access可使用户访问在会话环境中查看通信，而不仅仅是分散的邮件，从而帮助他们处理每天收到的大量邮件。 Microsoft Outlook Web Access在实现上存在安全限制绕过漏洞，远程攻击者可利用此漏洞劫持Web会话或通过重放攻击绕过身份验证，并获取受害者的电子邮件帐户。 SideJacking是窃取Web cookie，然后重放以克隆另一用户的Web会话的过程，使用克隆的Web会话，攻击者可利用受害者之前建立的站点访问。这可使读取网络报文的攻击者窃取所有提交给服务器的数据或客户端查看的网页。 Microsoft...

Cross site scripting

Cross-site scripting XSS vulnerability in Cyber-Ark Password Vault Web Access PVWA 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0459

CVE-2011-0459 : Cross-site scripting (XSS) in Cyber-Ark Password Vault Web Access (PVWA) affects PVWA v5.0 and earlier, v5.5–v5.5 patch 4, and v6.0–v6.0 patch 2. The vulnerability allows remote attackers to inject arbitrary web script/HTML via unspecified vectors, potentially executing in the bro...

PT-2011-2362

Name of the Vulnerable Software and Affected Versions Cyber-Ark Password Vault Web Access versions 5.0 and earlier Cyber-Ark Password Vault Web Access versions 5.5 through 5.5 patch 4 Cyber-Ark Password Vault Web Access versions 6.0 through 6.0 patch 2 Description The issue allows remote attacker...

CVE-2011-0459: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cyber-Ark Password Vault Web Access PVWA 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

[SECURITY] Fedora 15 Update: zabbix-1.8.6-1.fc15

ZABBIX is software that monitors numerous parameters of a network and the health and integrity of servers. ZABBIX uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. ZABBIX offers...

CVE-2011-1263

Cross-site scripting XSS vulnerability in the logon page in Remote Desktop Web Access RD Web Access in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in Remote Desktop Web Access RD Web Access in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."...

CVE-2011-1263

The CVE describes a cross-site scripting (XSS) vulnerability in the logon page of Remote Desktop Web Access (RD Web Access) on Microsoft Windows Server 2008 R2 and R2 SP1. The issue arises from insufficient input sanitization in the login URI, allowing remote attackers to inject arbitrary HTML/ J...

CVE-2011-1263

Cross-site scripting XSS vulnerability in the logon page in Remote Desktop Web Access RD Web Access in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."...

Microsoft Remote Desktop Web Access 跨站脚本漏洞

Bugtraq ID: 49040 CVE ID：CVE-2011-1263 Microsoft Windows是一款流行的操作系统。 传递给远程桌面WEB访问登录页面的部分输入在返回用户之前缺少过滤，这可导致跨站脚本攻击，可在目标用户浏览器上执行任意HTML和脚本代码。 Microsoft Windows Server 2008 R2 x64 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息：...

PT-2011-3000

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 and R2 SP1 Description A cross-site scripting XSS issue exists in the logon page of Remote Desktop Web Access RD Web Access, allowing remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2011-1263: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the logon page in Remote Desktop Web Access RD Web Access in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."...