CVE-2016-10304

The CVE-2016-10304 entry concerns SAP NetWeaver AS JAVA 7.5, specifically the EP-RUNTIME component. Affected component: SAP EP-RUNTIME within SAP NetWeaver AS JAVA 7.5. Root cause: remote authenticated users can trigger a denial of service via a crafted serialized Java object, as demonstrated by ...

CVE-2016-10304

The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service out-of-memory error and service instability via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788...

CVE-2016-10304: Deserialization of Untrusted Data

The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service out-of-memory error and service instability via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788...

PT-2017-7849

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5 Description The issue allows remote authenticated users to cause a denial of service, resulting in an out-of-memory error and service instability, by sending a crafted serialized Java object. Recommendations F...

Schneider Electric Wonderware InTouch Access Anywhere Privilege Gain Vulnerability

Schneider Electric Wonderware InTouch is an open, scalable HMI and SCADA monitoring solution from Schneider Electric, France, that creates standardized, reusable visualization applications.Wonderware InTouch Access Anywhere is a product that provides access to InTouch applications through a web...

Open redirect

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct Open Redirect attacks via the submit-url parameter to certain /goform/ pages...

CVE-2016-10316

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout...

CVE-2016-10315

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct Open Redirect attacks via the submit-url parameter to certain /goform/ pages...

CVE-2016-10313

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct CSRF attacks via certain /goform/ pages...

CVE-2016-10315

CVE-2016-10315 involves Jensen of Scandinavia Air:Link routers (AL3G 2.23m Rev.3; AL5000AC 1.13; AL59300 1.04 Rev.4). The vulnerability allows remote attackers to perform Open Redirects through the submit-url parameter on certain /goform/* pages. The underlying issue is an input handling flaw tha...

CVE-2016-10316

CVE-2016-10316 affects Jensen of Scandinavia Air:Link devices: AL3G (2.23m Rev. 3), AL5000AC (1.13), and AL59300 (1.04 Rev. 4). The vulnerability is an Open Redirect in the /goform/formLogout endpoint, triggered by manipulating the return-url parameter to redirect users to an arbitrary URL. Root ...

CVE-2016-10312

Affected devices : Jensen of Scandinavia Air:Link family — AL3G (2.23m Rev.3), AL5000AC (v1.13), AL59300 (v1.04 Rev.4). Vulnerability : remote attackers can execute arbitrary commands by injecting shell metacharacters into certain /goform/* pages. This is a command-injection style issue impacting...

CVE-2016-10313

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct CSRF attacks via certain /goform/ pages...

CVE-2016-10314

The CVE-2016-10314 entry affects Jensen of ScandinaviaAir:Link devices: AL3G (2.23m, Rev. 3), AL5000AC (1.13), and AL59300 (1.04, Rev. 4). The issue is an information-disclosure vulnerability allowing remote attackers to read passwords via a direct request to the x.asp page. The Red Hat/NVD entri...

CVE-2016-10316: URL Redirection to Untrusted Site

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout...

CVE-2016-10314: Exposure of Sensitive Information to an Unauthorized Actor

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to read passwords via a direct request to the x.asp page...

BGP Hijack Detection: TaBi

BGP Hijack Detection Developed since 2011 for the needs of the French Internet Resilience Observatory , TaBi is a framework that ease the detection of BGP IP prefixes conflicts, and their classification into BGP hijacking events. The term prefix hijacking refers to an event when an AS, called an...

CVE-2016-7145

The mauthenticate function in ircd/mauthenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter...

Informatica: Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]

POC === 1. Under "Your Stuff" choose to "Create a Discussion/Ask a question" 2. Choose a space to submit your discussion/question. Any space will do. 3. Title your discussion with the payload " 4. Choose "Post message" to publish. 5. View the message as any user. Under "Actions" choose to "Send a...

CVE-2017-5372

The function msp aka MSPRuntimeInterface in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the 1 getInformation, 2 getParameters, 3 getServiceInfo, 4 getStatistic, or 5 getClientStatistic...