CVE-2015-4188

Cisco Prime Collaboration Manager SQL Injection (CVE-2015-4188) affects the Manager interface of Cisco Prime Collaboration 10.5(1). A lack of input validation on user-supplied input in SQL queries allows remote attackers to craft URLs to execute arbitrary SQL commands, potentially exposing or man...

Cisco Prime Collaboration Manager SQL Injection Vulnerability

Cisco Prime Collaboration is the United States Cisco Cisco a set of enterprise collaboration network management solutions. The program supports a unified management console to simplify the management of unified communications and video collaboration network, as well as rapid deployment of...

Cisco Prime Collaboration Manager SQL Injection Vulnerability

A vulnerability in the Cisco Prime Collaboration Manager interface could allow an unauthenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An...

[SECURITY] Fedora 22 Update: fusionforge-5.3.2-4.fc22

FusionForge provides many tools to aid collaboration in a development project, such as bug-tracking, task management, mailing-lists, SCM repository, forums, support request helper, web/FTP hosting, release management, etc. All these services are integrated into one web site and managed through a...

[SECURITY] Fedora 21 Update: fusionforge-5.3.2-4.fc21

FusionForge provides many tools to aid collaboration in a development project, such as bug-tracking, task management, mailing-lists, SCM repository, forums, support request helper, web/FTP hosting, release management, etc. All these services are integrated into one web site and managed through a...

Zarafa Collaboration Platform Local Arbitrary File Write Vulnerability

Zarafa Collaboration Platform is a suite of open source email and calendaring software. A security vulnerability in the provider/server/ECServer.cpp file of Zarafa Collaboration Platform allows a local attacker to write arbitrary files by performing a symbolic link attack on the...

CVE-2015-3436

provider/server/ECServer.cpp in Zarafa Collaboration Platform ZCP before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock...

Code injection

provider/server/ECServer.cpp in Zarafa Collaboration Platform ZCP before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock...

CVE-2015-3436

provider/server/ECServer.cpp in Zarafa Collaboration Platform ZCP before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock...

CVE-2015-3436

Zarafa Collaboration Platform (ZCP) is affected by CVE-2015-3436 due to a symlink attack on /tmp/zarafa-upgrade-lock in provider/server/ECServer.cpp. Affects ZCP before 7.1.13 and 7.2.x before 7.2.1, enabling local users to write arbitrary files. Remediation per sources: upgrade to 7.1.13 or 7.2....

[SECURITY] Fedora 21 Update: zarafa-7.1.12-2.fc21

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

EasyIO-30P-SF Hard-Coded Credential Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on August 25, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified a hard-coded credential vulnerability in the EasyIO-30P-SF controller. EasyIO has produced a...

Security Researchers Publish Comments on Wassenaar Rules

With the two-month comment period for the proposed U.S. Wassenaar Arrangement rules barely under way, a cast of influential security researchers has wasted no time preparing and submitting their thoughts on the controversial proposal. Researchers who seek out vulnerabilities in software—developin...

Cisco Prime Central for Hosted Collaboration Solution Cross-Site Request Forgery Vulnerability

Cisco Prime is a service-centric solution that integrates the management of wired and wireless LANs, WANs and data centers from endpoints, network devices and applications, and filters information. A cross-site request forgery vulnerability exists in Cisco Prime Central for Hosted Collaboration...

Cisco Hosted Collaboration Solution Arbitrary Command Execution Vulnerability

Cisco Hosted Collaboration Solution HCS is a suite of hosted collaboration solutions. The solution includes Cisco TelePresence, Customer Collaboration and Unified Communications products to support customers using collaboration technologies in public, private and hybrid cloud models. A security...

Design/Logic Flaw

The administrative web interface in Cisco Hosted Collaboration Solution HCS 10.61 and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786...

CVE-2015-0750

The administrative web interface in Cisco Hosted Collaboration Solution HCS 10.61 and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786...

CVE-2015-0750

The administrative web interface in Cisco Hosted Collaboration Solution HCS 10.61 and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution PC4HCS 10.61 and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596...

CVE-2015-0741

CVE-2015-0741 affects Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) versions down to 10.6(1) and earlier. The issue is multiple cross-site request forgery (CSRF) vulnerabilities (Bug ID CSCut04596) that could allow remote attackers to hijack the authentication of arbitrary users....