Design/Logic Flaw

IBM Tivoli Monitoring Portal v6 could allow a local network adjacent attacker to execute arbitrary commands on the system, when default client-server default communications, HTTP, are being used. IBM X-Force ID: 123493...

R7-2017-02: Hyundai Blue Link Potential Info Disclosure (FIXED)

Summary Due to a reliance on cleartext communications and the use of a hard-coded decryption password, two outdated versions of Hyundai Blue Link application software, 3.9.4 and 3.9.5 potentially expose sensitive information about registered users and their vehicles, including application...

Siemens SiPass Integrated Unauthorized Operation Vulnerability

SiPass server is a component of the SiPass centralized access control system that receives connections from clients for communication. An unauthorized operation vulnerability exists in Siemens SiPass integrated, where an attacker in an intermediate location between the SiPass integrated server an...

More on the NSA's Use of Traffic Shaping

"Traffic shaping" -- the practice of tricking data to flow through a particular route on the Internet so it can be more easily surveiled -- is an NSA technique that has gotten much less attention than it deserves. It's a powerful technique that allows an eavesdropper to get access to communicatio...

Node Spoof

Solr is vulnerable to node spoof. When using the BasicAuth authentication mechanism through the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", attackers are able to spoof...

[SECURITY] Fedora 24 Update: globus-io-11.9-1.fc24

The Globus Toolkit is an open source software toolkit used for building Grid systems and applications. It is being developed by the Globus Alliance and many others all over the world. A growing number of projects and companies are using the Globus Toolkit to unlock the potential of grids for thei...

CVE-2015-5378

Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server...

PT-2017-6846

Name of the Vulnerable Software and Affected Versions Logstash versions 1.4.x through 1.4.3 Logstash versions 1.5.x through 1.5.2 Description The issue allows remote attackers to read communications between Logstash Forwarder agent and Logstash server. Recommendations For Logstash versions 1.4.x...

CVE-2017-6668

Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected...

CVE-2017-6670

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.17ER1...

Open redirect

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.17ER1...

Sql injection

Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected...

CVE-2017-6668

CVE-2017-6668 affects the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM). The issue is an SQL Injection caused by insufficient validation of user-supplied input in HTTP request parameters, allowing an authenticated, remote attacker to impact confidentiality by executing arbi...

PT-2017-17229

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Domain Manager version 8.17ER1 Description The issue allows an authenticated, remote attacker to execute arbitrary SQL queries, potentially impacting the confidentiality of the system. This is due to vulnerabilitie...

CVE-2017-6670: URL Redirection to Untrusted Site

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.17ER1...

PT-2017-17231

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Domain Manager version 8.17ER1 Description A vulnerability in the web-based GUI could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, also known as an Open Redirect issue...

CVE-2017-6668: Improper Neutralization of Special Elements used in an SQL Command

Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected...

Cisco Unified Communications Domain Manager Open Redirect Vulnerability

Cisco Unified Communications Manager is a call processing component of a Cisco IP telephony solution. An open redirection vulnerability exists in Cisco Unified Communications Domain Manager, which allows remote attackers to redirect users to an arbitrary website and conduct phishing attacks via...

Cisco Unified Communications Domain Manager SQL Injection Vulnerabilities

Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerabilities are due to insufficient validation of user-supplied input in...

Cisco Unified Communications Domain Manager Open Redirect Vulnerability

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of HTTP request parameters by the affected software. An attacker...