Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web GUI of the Cisco Application Networking Manager ANM and the Device Manager DM in the Cisco ACE 4710 Application Control Engine ACE Appliance could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web...

CVE-2015-0651

Cross-site request forgery CSRF vulnerability in the web GUI in Cisco Application Networking Manager ANM, and Device Manager DM on Cisco 4710 Application Control Engine ACE appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web GUI in Cisco Application Networking Manager ANM, and Device Manager DM on Cisco 4710 Application Control Engine ACE appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753...

CVE-2015-0651

CVE-2015-0651 is a CSRF vulnerability affecting Cisco Application Networking Manager (ANM) and the Device Manager (DM) on the Cisco ACE 4710 appliance. The issue stems from insufficient CSRF protections in the web GUI, allowing an unauthenticated, remote attacker to force arbitrary requests in th...

Cisco Application Control Engine GNU glibc gethostbyname Function Buffer Overflow Vulnerability (cisco-sa-20150128-ghost) (GHOST)

The Cisco Application Control Engine ACE software installed on the remote Cisco IOS device is version A23.6d or A53.1b. It is, therefore, affected by a heap-based buffer overflow vulnerability in the GNU C Library glibc due to improperly validating user-supplied input to the nsshostnamedigitsdots...

KLA10501 Code execution Redaxscript vulnerability

SQL injection vulnerability was found in Redaxscript. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a searchterms parameters. Original advisories - Exploitation Public exploits exist for this vulnerability. Related...

KLA10452 Multiple vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware products. Malicious users can exploit these vulnerabilities to gain privileges or cause denial of service. Below is a complete list of vulnerabilities 1. Vectors related to file write can be exploited locally; 2. Improper input validation...

KLA10476 Code execution vulnerability in Microsoft products

Buffer overflow was found in Microsoft products. By exploiting this vulnerability malicious users execute arbitrary code. This vulnerability can be exploited remotely via a specially designed packets related to Telnet service. Original advisories MS advisory CVE-2015-0014 Related products...

KLA10447 Multiple vulnerabilities in Java SE

Multiple serious vulnerabilities have been found in Oracle products. Malicious users can exploit these vulnerabilities to cause loss of integrity, denial of service and obtain sensitive information. Below is a complete list of vulnerabilities 1. Vectors relsted to Swing, Hotspot, JAX-WS,...

KLA10445 ACE vulnerability in Mozilla

Improper DOM objects interaction was found in Mozilla products. By exploiting this vulnerability malicious users can execute arbitrary code. This culnerability can be exploited remotely via unspecified vectors. Original advisories MFSA Related products Mozilla-Firefox Mozilla-SeaMonkey CVE list...

Samsung KNOX remote silent installation vulnerabilities in-depth analysis of the report-vulnerability warning-the black bar safety net

Vulnerability sources 1 1 In mid-May, the Samsung phone is a foreign security researchers exposed a serious security vulnerability,the vulnerability affects the Galaxy S5,S4,S4 mini,Note 4,Note3 and Ace 4 supports knox, a full line of Samsung phones, part of the GalaxyS5, and the Note 4 has been...

Samsung Galaxy KNOX Android Browser - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'digest/md5' class Metasploit3 0|1 if an HTTP request has been made to download a payload of that ID attrreader :servedpayloads def...

Samsung Galaxy KNOX Android Browser Remote Code Execution Exploit

This Metasploit module exploits a vulnerability that exists in the KNOX security component of the Samsung Galaxy firmware that allows a remote webpage to install an APK with arbitrary permissions by abusing the 'smdm://' protocol handler registered by the KNOX component. The vulnerability has bee...

KLA10604 Multiple vulnerabilities in Microsoft SharePoint

Multiple serious vulnerabilities have been found in Microsoft SharePoint. Malicious users can exploit these vulnerabilities to gain privileges or execute arbitrary code. Below is a complete list of vulnerabilities 1. XSS vulnerability can be exploited remotely via a specially designed requests; 2...

KLA10354 ACE vulnerability in Symantec Endpoint Protection

A buffer overflow was found in Symantec products. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a specially designed argument. Original advisories Symantec advisory Exploitation Public exploits exist for this...

KLA10359 Vulnerability in Tableau

An obsolete version of OpenSSL was found in Tableau. By exploiting this vulnerability malicious users can cause denial of service, obtain sensitive information and bypass security. This vulnerability can be exploited remotely. Original advisories Tableau changelog Exploitation Public exploits exi...

CVE-2014-0875

Active Cloud Engine ACE in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions...

Design/Logic Flaw

Active Cloud Engine ACE in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions...

CVE-2014-0875

IBM Storwize V7000 Unified ACE contains a race condition in NFS retransmissions that can bypass ACLs, affecting releases 1.3.0.0–1.4.3.x. A fix is available in 1.5.0.0 or later; upgrade to mitigate. The issue arises when ACE manages ACLs during network retransmissions and could grant unauthorized...

KLA10236 ACE vulnerability in Kerio Control

An SQL injection vulnerability was found in Kerio Control. By exploiting this vulnerability malicious users can execute arbitrary SQL. This vulnerability can be exploited remotely via a specially designed php call. Original advisories Release history Exploitation Public exploits exist for this...