Concrete CMS: Content Spoofing possible in concrete5.org

An attacker can include any arbitrary text using specially crafted concrete5 url. This is done using character /%0d%0a. Input https://www.concrete5.org/%0d%0ahas%20moved%20to%20www.evil.com.Please%20visit%20evil.com%20Present%20resource Output The requested URL / has moved to www.evil.com.Please...

IBM BigFix Cross-Site Scripting Vulnerability

IBM BigFix formerly known as IBM Endpoint Manager, Tivoli Endpoint Manager is a suite of systems management software from the American company IBM. A cross-site scripting vulnerability exists in the BES Gather feature of the IBM BigFix platform, which can be exploited by remote attackers with the...

ManageEngine ADSelfService Plus < 5.3 Build 5313 PasswordSelfServiceAPI XSS

The ManageEngine ADSelfService Plus application running on the remote host is affected by a cross-site scripting XSS vulnerability in PasswordSelfServiceAPI due to improper sanitization of user-supplied input to the 'PSSOPERATION' parameter. An unauthenticated, remote attacker can exploit this, v...

The vulnerability of the network virtualization tool for testing software from HP Network Virtualization allows a hacker to read arbitrary files.

The vulnerability of the network virtualization tool for testing software from HP Network Virtualization. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files using a specially crafted URL when accessing components like HttpServlet or...

Cisco Prime Collaboration Deployment SQL Injection Vulnerability

A vulnerability in the interface of the Cisco Prime Collaboration Deployment SQL database could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation for user-supplied input in...

IBM Rational Engineering Lifecycle Manager Information Disclosure Vulnerability

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A security vulnerability in IBM Rational Engineering Lifecycle Manager allows remote attackers to submit specially crafted URLs to obtain sensitive information...

Cisco Cloud Network Automation Provisioner SQL Injection Vulnerability

A vulnerability in the web framework of Cisco Cloud Network Automation Provisioner CNAP could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to a failure to validate user-supplied input in SQL...

Important: mercurial

Issue Overview: It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code. CVE-2016-3068 The binary delta decoder in Mercurial before 3.7...

Cisco TelePresence Server Denial of Service Vulnerability (CNVD-2016-02065)

Cisco TelePresence is a Cisco TelePresence solution. Cisco TelePresence Server versions 4.12.29-4.24.17 HTTP parsing engine fails to properly handle constructed URLs, which can allow an unauthenticated, remote attacker to cause reloading of the affected device...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions.

The vulnerabilities of the browser/devtools/devtoolsuibindings.cc and WebKit/Source/devtools/frontend/Runtime.js functions within the Developer Tools subsystem of the Google Chrome browser are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to...

Fedora 22 : git-2.4.3-7.fc22 (2015-cf767c77c1)

git-2.1.0-6.fc21 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.4.3-7.fc22 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.5.0-2.fc23 - fix arbitrary code execution via crafted URLs Resolves: 1269797 Note that Tenable Network Security has extracted...

Fedora 23 : git-2.5.0-2.fc23 (2015-05b74288af)

git-2.1.0-6.fc21 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.4.3-7.fc22 - fix arbitrary code execution via crafted URLs Resolves: 1269797 git-2.5.0-2.fc23 - fix arbitrary code execution via crafted URLs Resolves: 1269797 Note that Tenable Network Security has extracted...

Multiple XSS vulnerabilities.

PMASA-2016-11 Announcement-ID: PMASA-2016-11 Date: 2016-02-25 Summary Multiple XSS vulnerabilities. Description By sending a specially crafted URL as part of the HOST header, it is possible to trigger an XSS attack. A weakness was found that allows an XSS attack with Internet Explorer versions...

CVE-2016-1627

The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted...

Oracle: Security Advisory (ELSA-2015-2515)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

git19-git security update

1.9.4-3.1 - fix arbitrary code execution via crafted URLs Resolves: 1273889 1.9.4-3 - fix CVE-2014-9390 Resolves: rhbz1220552...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input in SQL...

WordPress Extredj Open Redirection

| / \ / \ | ' | | \ \ /\ / / | | | | | | '| ' \ | | | | | | | |\ V V /| || | || | | | | | | | | || || |||| // / /|| || || || Wordpress Extredj Plugin - Open Redirect Vulnerability My + Author : KnocKout Contact : [email protected] Skype : [email protected] HomePage : http://milw00rm.com -...

Cisco Unified Communications Manager SQL Injection Vulnerability

A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a blind SQL injection attack on a specific page. The vulnerability is due to a failure to validate user-supplied input used in SQL queries. An attacker could exploit this vulnerability...

Ubuntu 14.04 LTS : Git vulnerability (USN-2835-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2835-1 advisory. Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this...