298 matches found
Hewlett Packard Enterprise Intelligent Management Center iccSelectDymicParam Expression Language Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...
CVE-2017-11355
Multiple cross-site scripting XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to the main page; the 2 beanReference parameter to the JavaBean viewer page; or the 3 pyTableName to the System database schema...
CVE-2016-6799
Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition...
SQL Injection Vulnerability in Multiple Parameters of Multiple Files of Dahua Alarm Operation and Management Platform Devices
Dahua Alarm Center Management Platform is a comprehensive system solution centered on alarm reception and processing. Dahua alarm operation and management platform equipment attachmentclearTempFile.action file of bean.recId parameter, attachmentgetAttList.action file of bean.recId parameter,...
Remote Code Execution (RCE) Through Deserialization
Jackson-databind is vulnerable to remote code execution attacks. These attacks are possible during bean deserialization and attackers are able to execute code and commands...
CVE-2016-2104
Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...
CVE-2016-2104
This CVE relates to multiple XSS vulnerabilities in Red Hat Satellite 5 (Spacewalk) where an attacker can inject arbitrary script/HTML via parameters such as label, package_name, search_subscribed_channels, channel_filter, or vectors like input:hidden /bean:message . The issue is documented acros...
Apache Struts < 1.3.10 / < 2.3.16.2 - ClassLoader Manipulation Remote Code Execution Exploit
Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts ClassLoader Manipulation Remote Code Execution',...
Mr Bean™ - Flying Teddy - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Mr Bean™ - Flying Teddy published at the 'play' market has multiple vulnerabilities...
Mr-Bean Surf - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Mr-Bean Surf published at the 'play' market has multiple vulnerabilities...
Killer Bean Unleashed - Dangerous filesystem permissions, Hardcoded secrets, MIT license vulnerabilities
HackApp vulnerability scanner discovered that application Killer Bean Unleashed published at the 'play' market has multiple vulnerabilities...
vanilla bean - vegan essen - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities
HackApp vulnerability scanner discovered that application vanilla bean - vegan essen published at the 'play' market has multiple vulnerabilities...
Jelly Bean Keyboard 4.3 Free - Dangerous filesystem permissions, Dynamic Code Loading, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application Jelly Bean Keyboard 4.3 Free published at the 'play' market has multiple vulnerabilities...
Hubspot CTA - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-012 - Unsupported
This module enables you to embed a Hubspot CTA buttons widget in a Bean block. The module allows configuration of a CTA ID and Account ID while adding a bean block for a CTA button, but doesn't sufficiently sanitise these parameters, allowing a potential cross-site scripting attack. This...
OpenSSLX509Certificate deserialization Vulnerability, CVE-2 0 1 5-3 8 2 5）cause analysis-vulnerability warning-the black bar safety net
Serialization Serialization, is the state of the object information can be converted to storage or transmission in the form of the process. During serialization, the object will be in its current state is written to a temporary or persistent storage area. The user can pass from the storage area t...
OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397)
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; Java SE Embedded 7u75; and Java SE Embedded 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX...
New Android Vulnerability Could Crash your Phones Badly
Bad week for Android. Just days after a critical Stagefright vulnerability was revealed in the widely popular mobile platform, another new vulnerability threatens to make most Android devices unresponsive and practically unusable to essential tasks. Security researchers at Trend Micro have...
Google Won't Patch WebView Prior to Android Jelly Bean
Hackers may have a perpetual shooting gallery of unpatched Android vulnerabilities at their disposal after it was disclosed today that Google no longer will provide WebView patches for older versions of its operating system. Researchers at Rapid7 have made mincemeat of WebView in Android Jelly...
WS: Incomplete fix for CVE-2013-2133
It was found that the fix for CVE-2013-2133 was incomplete: the JAX-WS handlers were being executed for outbound messages even when authorization had failed. A remote attacker who is authorized to access the EJB class, could invoke a JAX-WS handler which they were not authorized to invoke...