CVE-2015-5820

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted 1 tel://, 2 facetime://, or 3 facetime-audio:// URL...

CVE-2015-5820

CVE-2015-5820 affects WebKit in Apple iOS prior to iOS 9. A crafted tel://, facetime://, or facetime-audio:// URL can trigger a dialing action, enabling remote dialing via web content. The documentation specifies the vulnerability arises from WebKit/URL handling; exploits or in‑the‑wild details a...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...

Symantec Web Gateway Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the path processing for command URLs accessed through the management port of the...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to inject arbitrary web or HTML code.

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code using a specially crafted...

CVE-2015-6465

The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service reboot via a crafted URL...

Code injection

The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service reboot via a crafted URL...

Microsoft Lync Server Cross-Site Scripting Vulnerability (CNVD-2015-05942)

Microsoft Lync is the next generation of integrated enterprise communication platform. Microsoft Lync Server 2013 and Skype for Business Server 2015, a cross-site scripting vulnerability exists in the jQuery engine, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2015-2532

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."...

The vulnerability of the iOS operating system allows a perpetrator to initiate arbitrary calls in FaceTime.

The vulnerability of the UIKit WebView component in the iOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to initiate arbitrary calls in FaceTime using a specially crafted URL...

Invision Power Services IPS Community Suite Resource Management Error Vulnerability

Invision Power Services IPS Community Suite a.k.a. Invision Power Board, IPB or Power Board is a PHP and MySQL based Web forum program from Invision Power Services, Inc. A security vulnerability exists in Invision Power Services IPS Community Suite 4.0.11 and earlier versions, which can be...

Code injection

Invision Power Services IPS Community Suite aka Invision Power Board, IPB, or Power Board before 4.0.12.1 allows remote attackers to cause a denial of service loop and memory consumption via a crafted URL...

CVE-2015-6812

Invision Power Services IPS Community Suite aka Invision Power Board, IPB, or Power Board before 4.0.12.1 allows remote attackers to cause a denial of service loop and memory consumption via a crafted URL...

AjaxPortal di.php File Inclusion (CVE-2009-2262)

A remote file inclusion vulnerability has been reported in AjaxPortal. The vulnerability is caused due to improper handling of crafted URL using the "pathtoserverdata" parameter. Successful exploitation will let the remote attacker to execute arbitrary PHP code...

Design/Logic Flaw

The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early poin...

CVE-2015-6658

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...

CVE-2015-6658

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...

Cross site scripting

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...