USN-2835-1 git vulnerability

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this issue to execute arbitrary code by injecting commands via crafted URLs...

git security update

1.8.3.1-6 - fix arbitrary code execution via crafted URLs Resolves: 1274737...

Design/Logic Flaw

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

Cisco Secure Access Control Server SQL Injection Vulnerability

A vulnerability in the Cisco Secure Access Control Server ACS interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. The vulnerability is due to a lack of input validation on user-supplied input within SQL queries...

Design/Logic Flaw

The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended access restrictions, and create administrative accounts or read data from arbitrary tenant domains, via a crafted URL, aka Bug IDs CSCus62671 and CSCus62652...

CVE-2015-5820

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted 1 tel://, 2 facetime://, or 3 facetime-audio:// URL...

Cisco Prime Collaboration Assurance Information Disclosure Vulnerability

A vulnerability in the web framework of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to access information about any device imported into the system database. The vulnerability is due to improper implementation of authorization and access controls. An attacker...

The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary web or HTML code.

The vulnerability of WebSphere Application Server applications exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject any desired web or HTML code using a specially crafted URL...

CVE-2015-2014

CVE-2015-2014 concerns an open redirect in the IBM Domino web server. The vulnerability affects IBM Domino 8.5 prior to 8.5.3 FP6 IF9 and 9.0 prior to 9.0.1 FP4, enabling remote attackers to redirect users to arbitrary sites via a crafted URL, which can facilitate phishing and enable cross-site s...

cURL and libcurl Cookie Path Parsing Remote Code Execution (CVE-2015-3145)

A heap buffer underflow vulnerability exists in cURL and libcurl. The vulnerability is due error when parsing a cookie path in an HTTP response. A remote, unauthenticated attackers can exploit this vulnerability by enticing user to perform a cURL on a crafted URL or provide malicious HTTP respons...

CVE-2015-0763

Cisco Unified MeetingPlace 8.61.2 does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338...

Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting (XSS)

A reflected XSS in "Simple Share Buttons Adder" before version 6.0.1 lead to a reflected cross-site scripting vulnerability on all pages where the "Simple Share Buttons Adder" was added usually all blog posts. Exploitation required that the browser did not encode the parameters sent to the server...

Code injection

The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL...

PYSEC-2015-5

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

IBM WebSphere Application Server Information Disclosure Vulnerability (CNVD-2014-09181)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An information disclosure vulnerability exists in IBM...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2014-09213)

IBM Rational Quality Manager is a Web-based collaboration tool that provides a sophisticated approach to test planning and test evaluation management within the software development lifecycle. A cross-site scripting vulnerability exists in IBM Rational Quality Manager versions 2.x through 2.0.1.1...

CVE-2014-8018

Cisco SA-20150106-CVE-2014-8018 describes a reflected XSS vulnerability in the web framework of Cisco Unified Communications Domain Manager (BVSM pages) allowing unauthenticated remote attackers to inject arbitrary script via a crafted link. Root cause: improper validation of user-supplied input....

CVE-2014-3187

Vulnerability CVE-2014-3187 affects Google Chrome on iOS: Chrome versions prior to 37.0.2062.60 and 38.x prior to 38.0.2125.59 fail to restrict processing of facetime:// and facetime-audio:// URLs, allowing a crafted website to obtain video and audio data from the device. Affected component is th...

CVE-2014-3304

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...

Design/Logic Flaw

The OutlookAction Class in Cisco WebEx Meetings Server allows remote attackers to enumerate user accounts by entering crafted URLs and examining the returned messages, aka Bug ID CSCuj81722...