Authorization

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...

CVE-2017-6391

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "adminconsole/web/tools/SimpleJWPlayer.php" URL, the "adminconsole/web/tools/AkamaiBroadcaster.php" URL, the "adminconsole/web/tools/bigRedButton.php...

CVE-2017-6392

An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/adminconsole/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the contex...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.14 / 8.5 < 8.5.5.12 / 9.0 < 9.0.0.3 Admin Console Multiple XSS

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.14, 8.5 prior to 8.5.5.12, or 9.0 prior to 9.0.0.3. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities in the Admin Console due to a failure to validat...

CVE-2016-6810

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation...

How to restrict access to the XenMobile Server Admin console

This will allow us to restrict the access and allow only specific IP addresses to reach the management portal of the XenMobile Server...

How To Configure Single Sign-on for Receiver for ChromeOS

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Receiver for Chrome now supports single sign-on SSON on Chromebook devices and Citrix Virtual...

CVE-2016-0782

CVE-2016-0782: Apache ActiveMQ 5.x prior to 5.11.4, 5.12.x prior to 5.12.3, and 5.13.x prior to 5.13.2 is vulnerable to cross-site scripting via the web admin console. The defect is improper validation of user-supplied input in the Admin Web console, enabling remote authenticated users to execute...

CVE-2016-0782

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting XSS attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the integrity of protected information.

Cross-site scripting XSS in the IBM WebSphere Application Server WAS and WebSphere Virtual Enterprise administration console allows authorized users to inject any web script or HTML code by using a specially crafted URL address...

Symantec Veritas NetBackup and NetBackup Appliance Weak Key Exchange Vulnerability

Symantec Veritas NetBackup NBU and NetBackup NBU Appliance are both products of Symantec USA. The former is a set of enterprise-class backup management software that can run on multiple operating systems, and the latter is an enterprise-class backup management appliance. A security vulnerability...

Zhone Technologies zNID GPON Remote Code Execution Vulnerability

Zhone Technologies zNID GPON 24xx, 24xxA, 42xx, 42xxA, 26xx and 28xx are router products from Zhone Technologies, USA. A remote code execution vulnerability exists in the web administrator console of the Zhone Technologies zNID GPON, which allows remote attackers to submit a special request to...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/http' require 'msf/core' class Metasploit3 'JBoss Seam 2 File Upload and Execute', 'Description' = %q Versions of the JBoss Seam 2 framework 'vulp1n3...

JBoss Seam 2 File Upload and Execute

Versions of the JBoss Seam 2 framework 'JBoss Seam 2 File Upload and Execute', 'Description' = %q Versions of the JBoss Seam 2 framework 2.2.1CR2 fails to properly sanitize inputs to some JBoss Expression Language expressions. As a result, attackers can gain remote code execution through the...

CVE-2014-8110

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-4003 · Apache · Apache Activemq

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions prior to 5.10.1 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities in the web-based administration console. These vulnerabilities allow remote attackers to inject arbitrary web script or...

Oracle GlassFish Server Unspecified Vulnerability (January 2015 CPU)

The version of GlassFish Server running on the remote host is affected by an unspecified vulnerability in the Admin Console. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid80949; scriptversion"1.10"; scriptcvsdate"Date: 2018/11/15 20:50:25"; scriptcveid"CVE-2015-0396...

Unspecified Vulnerability in Oracle Directory Server Enterprise Edition Admin Console Subware

Oracle Directory Server Enterprise Edition is a directory services solution developed by Oracle. A security vulnerability in the Oracle Directory Server Enterprise Edition Admin Console child allows remote attackers to exploit the vulnerability to compromise system integrity...

Oracle GlassFish Server Admin Console Subware Arbitrary Code Execution Vulnerability

Oracle GlassFish Enterprise Server is an open source and open community platform for building and deploying next-generation applications and services. A security vulnerability in the Oracle GlassFish Enterprise Server management console widget allows remote attackers to exploit the vulnerability ...