UBUNTU-CVE-2016-7999

ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...

Cross-Site Request Forgery Vulnerability in Carlo Gavazzi Automation VMU-C EM and VMU-C PV

Carlo Gavazzi Automation VMU-C EM and VMU-C PV are control modules in the automation products of the Italian company Carlo Gavazzi Automation. A cross-site request forgery vulnerability exists in the Carlo Gavazzi Automation VMU-C EM and VMU-C PV. A remote attacker can exploit the vulnerability b...

DEBIAN-CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

ALPINE-CVE-2016-9861

An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

IBM Cloud Orchestrator Local Denial of Service Vulnerability

IBM Cloud Orchestrator is a suite of solutions from IBM USA that provides cloud management for IT services and accelerates software and infrastructure delivery. The solution provides capabilities such as extending on-premise and off-premise cloud services as well as application program interfaces...

CVE-2016-0273

Cross-site scripting XSS vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0...

UBUNTU-CVE-2016-5292

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox 50...

cURL/libcURL Security Bypass Vulnerability (CNVD-2016-10793)

cURL/libcURL is a command line file transfer tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP. A security bypass vulnerability exists in cURL/libcURL due to a "" ending in an illegal url, which allows attackers to bypass security restrictions and perform unauthorized...

Citrix NetScaler ADC URL Redirection Vulnerability

Citrix NetScaler ADCs are application delivery controllers that optimize enterprise service delivery. A URL redirection vulnerability exists in Citrix NetScaler ADC. An attacker could exploit this vulnerability to allow users to access the attacker's malicious links without notice...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

Rotten Apples: Resurgence

In June 2016, we published a blog about a phishing campaign targeting the Apple IDs and passwords of Chinese Apple users that emerged in the first quarter of 2016 referred to as the “Zycode” phishing campaign. At FireEye Labs we have an automated system designed to proactively detect newly...

IBM Security Guardium Cross-Site Scripting Vulnerability

IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. A cross-site scripting vulnerability exists in IBM Security Guardium. A remote attacker could exploit...

UBUNTU-CVE-2016-7046

Red Hat JBoss Enterprise Application Platform EAP 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service CPU and disk consumption via a long URL...

baserCMS plugin Blog vulnerable to cross-site request forgery

Overview baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS and bundled plugin Blog contain a cross-site request forgery vulnerability. Isao Takaesu of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with t...

ASUS RT-N10E URL Redirection Vulnerability

ASUS RT-N10E Wireless Router is a wireless router device developed by ASUS. A URL redirection vulnerability exists in ASUS RT-N10E. Allowing an attacker can exploit the vulnerability to conduct redirection attacks...

plone reflective cross-site scripting vulnerability (CNVD-2016-07280)

Plone is a free, open source Content Management System CMS. Plone's URL detection architecture includes a way to detect if the URL is valid and located in plone's site. XSS can be achieved by passing js into a specially crafted url...

Cisco Hosted Collaboration Mediation Fulfillment Directory Traversal Vulnerability (CNVD-2016-07110)

Cisco Hosted Collaboration Solution HCS is a cloud service that provides communication and collaboration solutions. A security vulnerability exists in the web interface of Cisco Hosted Collaboration Mediation Fulfillment. Due to the program not properly validating the HTTP URL format. An...

chromium-browser: Parameter sanitization failure in DevTools

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

UBUNTU-CVE-2016-5143

The Developer Tools aka DevTools subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different...

SQL Injection Vulnerability in the Remote Consultation System of Beijing Blue Weather Technology Co.

BlueWell is a high-tech enterprise specializing in providing telemedicine services, and has constructed a nationwide telemedicine service platform, realizing a system platform for teleconsultation, specialist diagnosis, remote monitoring, surgical demonstration, two-way referral, remote education...