CVE-2016-1387

The XML API in TelePresence Codec TC 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint CE 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make configuration changes v...

CVE-2016-1387

Cisco TelePresence TC (Codec) 7.2.x–7.3.x and CE (Collaboration Endpoint) 8.0.x–8.1.x are affected by an authentication bypass in the XML API due to improper authentication implementation. An unauthenticated, remote attacker can bypass XML API authentication and perform configuration changes or i...

CVE-2016-1392

Cisco Prime Collaboration Assurance Software versions 10.5–11.0 suffer an open redirect vulnerability in the web interface due to improper input validation of HTTP request parameters. An unauthenticated, remote attacker could entice a user to click a crafted link and redirect them to a malicious ...

Cisco TelePresence XML Application Programming Interface Authentication Bypass Vulnerability

A vulnerability in the XML application programming interface API of Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, remote attacker to bypass authentication and access a targeted system through the API. The vulnerability is due to improper...

Open Atrium Notifications - Less Critical - Information Disclosure - SA-CONTRIB-2016-026

Open Atrium is a distribution of Drupal that allows you to build collaborative web sites. The Open Atrium Notification module adds the ability to send email notifications to users subscribed to certain content. When combined with the Open Atrium Mailhandler app, incoming email replies to...

Cisco Prime Collaboration Assurance Open Redirect Vulnerability

A vulnerability in the web interface of Cisco Prime Collaboration Assurance Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of HTTP request parameters by the affected software. An attacker...

Ruggedization Framework For Security Testing: Gauntlt

Gauntlt is a ruggedization framework that is enables security testing that is usable by devs, ops and security. Gauntlt provides hooks to a variety of security tools and puts them within reach of security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testin...

Katie Moussouris on Free ISO 29147

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributor is Katie Moussouris @k8em0. Today marks an exciting development in the often monotonous rehashing of vulnerability disclosure. The ISO standard tha...

Zimbra Collaboration Server Mail Interface Cross-Site Request Forgery Vulnerability

Zimbra Collaboration Server ZCS is a suite of email and collaboration solutions from Zimbra, USA. The solution provides email, contacts, calendaring, file sharing, social networking, and more. A cross-site request forgery vulnerability exists in the Mail interface of Zimbra Collaboration Server...

用友FE协作办公平台 /common/parseTree.jsp 等2处 SQL注入漏洞

No description provided by source...

collaboration.worldbank.org XSS vulnerability

Vulnerable URL: https://collaboration.worldbank.org/groups/lli-partners/tags?tags=%22%3E%3C/option%3E%3C%20/select%3E%3Cbody/onpageshow=prompt%28%29%3E%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:...

Cisco IP Interoperability and Collaboration System Version Detection

This Script performs SSH based detection of Cisco IP Interoperability and Collaboration System SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ...

CVE-2016-1375

Cisco IP Interoperability and Collaboration System (IOS) 4.10(1) contains an XSS flaw in the web framework code that allows remote attackers to inject arbitrary script or HTML via a crafted URL. The vulnerability stems from insufficient XSS protections and can be exploited by convincing a user to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Mail interface in Zimbra Collaboration Server ZCS before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest...

CVE-2015-6541

Zimbra Collaboration Server (ZCS) Mail interface is affected by CSRF in versions before 8.5. An attacker can exploit a crafted SOAP BatchRequest to change account preferences and hijack user authentication. Public PoCs/exploits exist (e.g., Exploit-DB 39500; 1337DAY) detailing remote CSRF without...

SAP NetWeaver Java AS RTC Service Information Disclosure Vulnerability

SAP NetWeaver is SAP's integrated technology platform and the technology foundation for all SAP applications since SAP Business Suite. A security vulnerability exists in the chat function of the RTC service in SAP NetWeaver Java AS version 7.4, which can be exploited by remote attackers to obtain...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

CVE-2016-3973

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

Security feature bypass

The chat feature in the Real-Time Collaboration RTC services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tcrtccoll.appl.rtcwdchat/Chat, pressing "Add users", and doing a search, aka SAP...

Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco IP Interoperability and Collaboration System could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to insufficient XSS protections. An attacker could exploit this vulnerability by...