6755 matches found
Sql injection
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...
CVE-2015-2999
CVE-2015-2999: SysAid Help Desk prior to 15.2 contains multiple SQL injection vulnerabilities. The injected vectors include (1) groupFilter in AssetDetails via /genericreport, (2) customSQL in TopAdministratorsByAverageTimer and (3) ActiveRequests via /genericreport, (4) dir parameter to HelpDesk...
CVE-2015-2994
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...
CVE-2015-2999
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...
Xen Denial of Service Vulnerability (CNVD-2015-03573)
Xen is an open source virtual machine monitor. Xen versions 3.3.x-4.5.x, fail to properly restrict write access to the host MSI message data field, which can be exploited by local x86 HVM client administrators to cause a denial of service unexpected outage and host crash...
CVE-2015-4103
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service host interrupt handling confusion via vectors related to qemu and accessing spanning multiple fields...
CVE-2015-4103
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service host interrupt handling confusion via vectors related to qemu and accessing spanning multiple fields...
CVE-2015-4103
Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service host interrupt handling confusion via vectors related to qemu and accessing spanning multiple fields...
CVE-2015-4162
XML external entity XXE vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data...
CVE-2015-4162
PAN-OS XXE vulnerability (CVE-2015-4162) affects the management interface. An authenticated PAN-OS user can craft XML to retrieve arbitrary content from the device. Impact: information disclosure. Affected versions: PAN-OS before 5.0.16; 6.x before 6.0.8; 6.1.x before 6.1.4. Mitigation/remediatio...
Potential unintended writes to host MSI message data field via qemu
ISSUE DESCRIPTION Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field...
Aruba Networks CPPM Remote Code Execution Vulnerability
Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM, which can be exploited by remote administrators to execute arbitrary code...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack the authentication of administrators...
CVE-2015-4132
Multiple cross-site scripting XSS vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors...
Directory traversal
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors...
Sql injection
Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allow remote administrators to inject arbitrary web script or HTML via unspecified vectors...
Directory traversal
Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager CPPM before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors...
CVE-2015-1550
The vulnerability affects Aruba Networks ClearPass Policy Manager (CPPM). CPPM versions before 6.4.5 are vulnerable to a directory traversal flaw that allows remote administrators to execute arbitrary files via unspecified vectors. Root cause is a directory traversal vulnerability in CPPM, leadin...