Code injection

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

The vulnerability of VMware Fusion’s hypervisor allows a attacker to trigger a failure in the hosting or host operating system.

The vulnerability of VMware Fusion exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker to cause a failure in the maintenance of 32-bit or 64-bit host operating systems using a specially crafted RPC request...

Palo Alto Networks PAN-OS Management Interface API Remote DoS (PAN-SA-2016-0008)

The Palo Alto Networks PAN-OS running on the remote host is affected by a denial of service vulnerability in the API hosted on the management interface, specifically in the panUserLogin function within panmodule.so, due to improper validation of user-supplied input to the 'username' and 'password...

The vulnerability of the Apache HTTP Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the deflateinfilter function of the moddeflate.c module in the Apache HTTP Server allows malicious actors to trigger a denial-of-service attack by sending a specially crafted request that is decompressed into a large amount of data...

CVE-2016-4433

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request...

Cross site request forgery (csrf)

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request...

CVE-2016-4433

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request...

CVE-2016-4433

CVE-2016-4433 affects Apache Struts 2.2.3.20–2.3.28.1, where a crafted request can bypass access restrictions and trigger redirection attacks. Multiple connected sources (NVD description; IBM advisories for Struts-related products) confirm the same affected range and attack pattern. The provided ...

Eaton ELCSoft Programming Software Stack Buffer Overflow Vulnerability

Eaton ELCSoft Programming Software is a suite of software for configuring programmable logic controllers. A stack buffer overflow vulnerability exists in Eaton ELCSoft Programming Software, which can be exploited by a remote attacker to submit a special request to execute arbitrary code...

CVE-2016-1289

The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager EPNM 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID...

CVE-2016-3647

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery SSRF attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request...

Server side request forgery (ssrf)

Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery SSRF attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request...

Trend Micro Deep Discovery hotfix_upload.cgi Document Name Remote Code Execution Vulnerability

Trend Micro Deep Discovery detects, analyzes, and responds to ransomware, real-time attacks, and more. Trend Micro Deep Discovery has a remote code execution vulnerability in the hotfixupload.cgi implementation, which can be exploited by a remote attacker to execute arbitrary code in the root...

Apache Struts REST Plugin DMI Code Execution (CVE-2016-3087)

A code execution vulnerability exists in Apache Struts. The vulnerability is due the way the OGNL expressions are processed when DMI is enabled and the REST plugin is used. A remote attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitatio...

OpenStack Ironic Authentication Bypass Vulnerability

OpenStack is a cloud platform management project developed by the National Aeronautics and Space Administration and Rackspace, Inc. Ironic is a component that provides bare-metal and virtual machine hypervisor interaction. A security vulnerability exists in Ironic. An attacker can exploit the...

Oracle Application Testing Suite Authentication Bypass (CVE-2016-0492)

An authentication bypass vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests. A remote attacker can exploit this vulnerability by sending crafted request to the vulnerable server...

Shopware getTemplateName Local File Inclusion (CVE-2016-3109)

A local file inclusion vulnerability has been reported in Shopware. This vulnerability is due to insufficient input validation in the getTemplateName method. A remote unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successful exploitati...

Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-04089)

Apache Struts is the United States Apache Apache Software Foundation is responsible for maintaining an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2...

IBM WebSphere MQ Denial of Service Vulnerability (CNVD-2016-03937)

IBM WebSphere MQ is a messaging middleware product. A denial of service vulnerability exists in IBM WebSphere MQ, which can be exploited by remote attackers to submit a special request for a denial of service attack...

CVE-2016-4450

os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...