Cross site scripting

Cross-site scripting XSS vulnerability in adfs/ls in Active Directory Federation Services AD FS in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability....

CVE-2015-1757

Cross-site scripting XSS vulnerability in adfs/ls in Active Directory Federation Services AD FS in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability....

CVE-2015-1757

CVE-2015-1757 is an XSS elevation-of-privilege vulnerability in Microsoft Active Directory Federation Services (AD FS) exposed by wct input in AD FS on Windows Server 2008 SP2, R2 SP1, and Server 2012. The issue, described as cross-site scripting via the wct parameter, can enable a remote attacke...

MS15-062: Vulnerability in Active Directory Federation Services Could Allow Elevation of Privilege (3062577)

The remote Windows host is affected by an XSS elevation of privilege vulnerability in Active Directory Federation Services AD FS due to improper sanitization of user-supplied input. A remote attacker can exploit this by submitting a specially crafted URL to a target site, resulting in the executi...

Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability

Microsoft Active Directory is an Active Directory service developed by Microsoft. A cross-site scripting vulnerability exists in Microsoft Active Directory Federation Services, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to...

Microsoft Active Directory Federation Services Privilege Escalation Vulnerability (3062577)

This host is missing an important security update according to Microsoft Bulletin MS15-062. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

June 2015 Microsoft Patch Tuesday Security Bulletins

IT administrators today were granted a relatively light month of security bulletins from Microsoft, which is likely to be welcomed given that Windows Server 2003 security support ends in little more than a month. Microsoft today released eight bulletins, two of them rated critical, including a...

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Description Microsoft Active Directory Federation Services is prone to a remote privilege-escalation vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to gain elevated privileges and perform unauthorized actions in the context of the currently...

MS15-062: Vulnerability in Active Directory federation services could allow elevation of privilege: June 9, 2015

None None...

CVE-2015-2999

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

XSS in JIRA via PDF attachment

PDF attachments are considered active content and can be used to xss users...

XSS in JIRA via PDF attachment

PDF attachments are considered active content and can be used to xss users...

WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

SOL16686 - Point-to-Point Protocol (PPP) vulnerability CVE-2015-3310

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

Microsoft Active Directory LDAP Request Memory Consumption (MS13-032) - Ver2 (CVE-2013-1282)

A denial of service vulnerability exists in the implementations of Active Directory. Successful exploitation could cause the service to stop responding. The vulnerability is caused when the LDAP service fails to handle a specially crafted query. A Remote attacker can exploit this issue via a...

[ MDVSA-2015:185 ] dokuwiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:185 http://www.mandriva.com/en/support/security/ Package : dokuwiki Date : March 31, 2015 Affected: Business Server 1.0 Problem Description: Updated dokuwiki packages fix security vulnerabilities:...

[SECURITY] Fedora 21 Update: realmd-0.15.2-2.fc21

realmd is a DBus system service which manages discovery and enrollment in r ealms and domains like Active Directory or IPA. The control center uses realmd as the back end to 'join' a domain simply and automatically configure things corre ctly...

Microsoft LAPS Tool Addresss Local Admin Password Problem

Microsoft’s release last week of the Local Administrator Password Solution LAPS takes some steps to address an old question of what to do with local admin passwords, but doesn’t provide a complete answer, experts said. Windows admins have long used a common local account with the same password on...

SQLassie - Effective Database Security

SQLassie is a free MySQL database firewall that prevents SQL injection attacks at runtime. SQLassie uses Bayesian classifiers to determine the likelihood of a query being an attack. This approach produces fewer false positives than other similar approaches. Security SQLassie prevents injection...

Windows Gather Active Directory BitLocker Recovery

This module will enumerate BitLocker recovery passwords in the default AD directory. This module does require Domain Admin or other delegated privileges. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...