PhreeBooks Input Validation Vulnerability

PhreeBooks is a suite of open source Web-based enterprise resource planning ERP and accounting applications that provide vendor account information management, inventory management and tracking, checking and bank reconciliation, and more. An input validation vulnerability exists in PhreeBooks. An...

CVE-2015-0651: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web GUI in Cisco Application Networking Manager ANM, and Device Manager DM on Cisco 4710 Application Control Engine ACE appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753...

CVE-2014-8877 - Code Injection in Wordpress CM Download Manager plugin

Vulnerability title: Code Injection in Wordpress CM Download Manager plugin CVE: CVE-2014-8877 Plugin: CM Download Manager plugin Vendor: CreativeMinds - https://www.cminds.com/ Product: https://wordpress.org/plugins/cm-download-manager/ Affected version: 2.0.0 and previous version Fixed version:...

CVE-2014-8951

Technical details (affected product, component, root cause, versions, or remediation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-8951

Unspecified vulnerability in Check Point Security Gateway R75, R76, R77, and R77.10, when UserCheck is enabled and the 1 Application Control, 2 URL Filtering, 3 DLP, 4 Threat Emulation, 5 Anti-Bot, or 6 Anti-Virus blade is used, allows remote attackers to cause a denial of service fwk0 process...

Android 5.0 Lollipop Encryption and Application Control

Google, like most technology companies in this climate, is fighting for the security and privacy of its users’ data on several fronts. With a mobile application ecosystem that invites trouble and government demands for user content and information continuing to rise, Google decided with Android...

Local Privilege Escalation Vulnerability in Symantec Endpoint Protection

US-CERT is aware of a local privilege escalation vulnerability in Symantec Endpoint Protection. This vulnerability affects all versions of Symantec Endpoint Protection Client 11.x and 12.x running Application and Device Control. Exploitation of this vulnerability may allow an attacker to gain ful...

PostNuke 0.6x/0.7x NS-Languages Module language Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/16752/info PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. Successful exploitation could allow an attacker to...

PostNuke 0.6x/0.7x NS-Languages Module language Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/16752/info PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. Successful exploitation could allow an attacker to...

123 Flash Chat 5.0 - Remote Code Injection Weakness

No description provided by source. source: http://www.securityfocus.com/bid/16360/info 123 Flash Chat is prone to an arbitrary code injection weakness. An attacker can influence the value of a variable that is insecurely passed to an 'eval' call. Successful exploitation may allow attackers to tak...

Check Point response to "Bypassing Application Control"

...

Cisco Application Control Engine Login Administrator IP Address Overlap (cisco-sa-20120620-ace)

The Cisco Application Control Engine ACE software installed on the remote Cisco IOS device is earlier than A42.3 / A51.1. It, therefore, potentially does not properly share a management IP address among multiple contexts when multicontext mode is enabled. This might allow an administrative user t...

Cisco Application Control Engine (ACE) Version

Cisco Application Control Engine ACE software is installed on the remote Cisco IOS or ACE device. It is a load-balancing and application-delivery solution for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers, and it is also available as an appliance. TRUSTED...

Check Point response to 'SSH encapsulated in DNS traffic is not detected by Application Control'

...

Ruby on Rails Active Record组件SQL注入漏洞(CVE-2012-6496)

CVE ID:CVE-2012-6496 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails Active Record组件存在一个SQL注入漏洞，允许攻击者利用"findby"方法进行SQL注入攻击，可获得敏感信息或控制应用系统。 0 Ruby on Rails 3.0.x Ruby on Rails 3.1.x Ruby on Rails 3.2.x 厂商解决方案 Ruby on Rails 3.0.18，3.1.9和3.2.10已经修复此漏洞，建议用户下载使用： http://www.ruby-lang.org...

Anti-Virus / Anti-Bot / Application Control / URL Filtering update might fail on R75.40 / R75.40VS / R75.45 / R75.46 / E80.41

...

Ruijie Application Control engine of the management server can increase user-vulnerability warning-the black bar safety net

Ruijie Application Control engine of the management server, the RG-ACE series Application Control engine of the management server V3. 1. 3 6. 0 0 1, The Official Website of the connection http://www.ruijie.com.cn/service/down-search.aspx the display is the latest version according to not authorit...

Multiple SQL Injection Vulnerabilities in Elite Bulletin Board

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Elite Bulletin Board, which can be exploited to perform SQL injection attacks. 1 Multiple SQL injection vulnerabilities in Elite Bulletin Board: CVE-2012-5874 The vulnerabilities exist due to insufficient sanitation of...

Check Point response to 'Bypassing application control SSH detection'

...

CVE-2012-3919: Undefined Security Weakness

The Cisco Application Control Engine ACE module 3.0 for Cisco Catalyst switches and Cisco routers does not properly monitor Load Balancer LB queues, which allows remote attackers to cause a denial of service incorrect memory access and module reboot via application traffic, aka Bug ID CSCtw70879...