CVE-2015-4247

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

CVE-2015-4246

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

CVE-2015-4245

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

CVE-2015-4249

CVE-2015-4249 entry is rejected; not an active vulnerability entry and not used in security assessments.

smack: MitM vulnerability

It was found that SSLSocket in Smack did not perform hostname verification. An attacker could redirect traffic between an application and an XMPP server by providing a valid certificate for a domain under the attacker's control...

Watcher v1.5.8 - Web Security Testing Tool and Passive Vulnerability Scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

MetInfo latest version of the arbitrary file read vulnerability warning-the black bar safety net

An attacker by submitting a carefully constructed parameters can get the server end of any file content! MetInfo 5.2 which is the current latest version include/thumb.php file originally used to get the thumbnail, but its structure is the thumbnail path to the presence of an external controlled...

Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability

A vulnerability within the login page of the web user interface of Cisco TelePresence Collaboration Desk and Room Endpoints devices running TC Software could allow an unauthenticated, remote attacker to conduct HTML redirection attacks. The vulnerability is due to improper input validation of...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Exploit

This Metasploit module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username'...

CVE-2015-2168

CVE-2015-2168 is rejected; this candidate was withdrawn and does not represent an active security issue.

WordPress Easing Slider Plugin Cross-Site Request Forgery (CVE-2015-1436)

A cross-site request forgery CSRF vulnerability has been reported in WordPress Easing Slider Plugin. An attacker could exploit this vulnerability by convincing the user to follow a malicious link or visit an attacker-controlled website...

SQLite3 3.8.6 - Controlled Memory Corruption (PoC)

Exploit Title: SQLite3 controlled memory corruption PoC 0day Date: date Exploit Author: Andras Kabai Vendor Homepage: http://www.sqlite.org/ Software Link: http://www.sqlite.org/download.html Version: 3.8.6, 3.8.8.3 Tested on: Ubuntu 14.10, 64 bit 3.8.6 latest available package, 3.8.8.3 built fro...

Microsoft Windows Group Policy Remote Code Execution (MS15-011; CVE-2015-0008)

A remote code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. An attacker can exploit this vulnerability by convincing a victim with a...

WordPress Image Metadata Cruncher Plugin Cross Site Request Forgery (CVE-2015-1614)

A cross-site request forgery CSRF vulnerability has been reported in WordPress Image Metadata Cruncher Plugin. An attacker could exploit this vulnerability by convincing the user to follow a malicious link or visit an attacker controlled website...

FreeBSD-SA-15:03.sctp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:03.sctp Security Advisory The FreeBSD Project Topic: SCTP stream reset vulnerability Category: core Module: sctp Announced: 2015-01-27 Credits: Gerasimos...

Advantech-AdamView-GNI

!/usr/bin/env ruby Exploit Title: Advantech AdamView .gni SEH Buffer Overflow Date: Dec 09 2014 Vulnerability Discovery: Daniel Kazimirow and Fernando Paez - Core Security Exploit Author: Muhamad Fadzil Ramli mind1355atgmail.com Software Link:...

PT-2024-34260 · Meetup · Meetup

Name of the Vulnerable Software and Affected Versions: Meetup versions 0.1 and earlier Description: The issue affects Meetup, allowing privilege escalation through an authorization bypass. This is due to a user-controlled key vulnerability. Recommendations: For versions 0.1 and earlier, at the...

Sandworm APT Team Found Using Windows Zero Day Vulnerability

UPDATE–A cyberespionage team, possibly based in Russia, has been using a Windows zero day vulnerability to target a variety of organizations in several countries, including the United States, Poland, Ukraine and western Europe. The vulnerability, which will be patched today by Microsoft, is...