Multiple Vulnerabilities in Cisco Email Security Appliance (cisco-sa-20130626-esa)

According to its self-reported version, the Cisco AsyncOS running on the remote Cisco Email Security ESA appliance is affected by multiple vulnerabilities : - An unspecified vulnerability exists in the web framework that could allow a remote, authenticated attacker to execute arbitrary commands...

Multiple Vulnerabilities in Cisco Web Security Appliance (cisco-sa-20130626-wsa)

According to its self-reported version, the version of Cisco Web Security Appliance running on the remote host has the following vulnerabilities : - Multiple unspecified vulnerabilities exist in the web framework that could allow a remote, authenticated attacker to execute arbitrary commands...

Design/Logic Flaw

The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restrictions and read unspecified web pages via crafted parameters, aka Bug ID CSCuh86385...

CVE-2013-3438: Undefined Security Weakness

The web framework in the server in Cisco Unified MeetingPlace Web Conferencing allows remote attackers to bypass intended access restrictions and read unspecified web pages via crafted parameters, aka Bug ID CSCuh86385...

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

CVE-2013-2165

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing a...

JBoss RichFaces 远程代码执行漏洞(CVE-2013-2165)

Bugtraq ID:61085 CVE ID:CVE-2013-2165 JBoss RichFaces是一个具 Ajax和JSF特性的Web框架 RichFaces ResourceBuilderImpl处理反序列化存在在安全漏洞，允许远程攻击者利用此漏洞发送特殊数据，执行部署在服务器上任意可序列化类中的反序列化方法 此漏洞所产生的影响其严重程序取决于这些类的反序列化逻辑 0 JBoss RichFaces 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： https://rhn.redhat.com/errata/RHSA-2013-1041.html...

PT-2013-4377

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Description A cross-site request forgery CSRF issue in the web framework allows remote attackers to hijack the authentication of arbitrary users. Recommendations At the moment,...

Cisco Unified Communications Domain Manager Memory Exhaustion Vulnerability

A vulnerability in the web framework of Cisco Unified Communications Domain Manager could allow an authenticated, remote attacker to exhaust available memory and crash several critical processes. The vulnerability is due to improper memory allocation when the affected system receives crafted HTTP...

RichFaces: Remote code execution due to insecure deserialization

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

Critical: Red Hat Security Advisory: Red Hat JBoss Web Framework Kit 2.3.0 update

Red Hat JBoss Web Framework Kit 2.3.0, which fixes one security issue, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS ba...

Webwork 2 code injection vulnerability

We have discovered a vulnerability in WebWork 2, which is a part of the Struts web framework. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. In case of Fisheye, the attacker needs to be able to access...

CVE-2013-3416: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web framework in the unified-communications management implementation in Cisco Unified Operations Manager and Unified Service Monitor allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuh47574 a...

PT-2013-4373

Name of the Vulnerable Software and Affected Versions Cisco Unified Operations Manager and Unified Service Monitor affected versions not specified Description A cross-site scripting XSS issue exists in the web framework of the unified-communications management implementation, allowing remote...

Webwork 2 code injection vulnerability

We have discovered a vulnerability in WebWork 2, which is a part of the Struts web framework. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. In case of Bamboo, the attacker needs to be able to access Bambo...

CVE-2013-3395

Cross-site request forgery CSRF vulnerability in the web framework on Cisco IronPort Web Security Appliance WSA devices, Email Security Appliance ESA devices, and Content Security Management Appliance SMA devices allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs...

Cisco Web Security Appliance Web框架任意命令执行漏洞(CVE-2013-3384)

CVECAN ID: CVE-2013-3384 Cisco Web Security Appliance是安全的Web网关，在一个平台上集成了恶意软件防护、应用可视化控制、策略控制等。Cisco IronPort AsyncOS是电子邮件安全设备。 Cisco Web Security Appliance设备上的IronPort AsyncOS在Web框架的实现上，以及Content Security Management Appliance设备和Email Security...

CVE-2013-3383

The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL sent over IPv4, aka Bug ID CSCzv69294...