CVE-2015-2816

The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a crafted request, aka SAP Security Note 2134905...

CVE-2015-2791

The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php...

Oracle GlassFish Server Administration Console Authentication Bypass - Ver2 (CVE-2011-1511)

An authentication bypass vulnerability has been reported in the administration console of Oracle GlassFish. The vulnerability is due to an error while processing HTTP TRACE requests. A remote attacker can exploit this vulnerability by sending a crafted TRACE request to the target. Successful...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka...

CVE-2015-1636

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."...

CVE-2015-1633

Cross-site scripting XSS vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka...

Microsoft SharePoint User Name XSS (MS15-022; CVE-2015-1633)

An elevation of privilege vulnerability exists in Microsoft SharePoint Server. The vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affecte...

CVE-2014-6115

IBM Rational Insight 1.1.1.5 allows remote attackers to bypass authentication and obtain sensitive information via a crafted request to a Jazz Reporting Service JRS report URL...

Authentication flaw

IBM Rational Insight 1.1.1.5 allows remote attackers to bypass authentication and obtain sensitive information via a crafted request to a Jazz Reporting Service JRS report URL...

CVE-2014-6115

IBM Rational Insight 1.1.1.5 allows remote attackers to bypass authentication and obtain sensitive information via a crafted request to a Jazz Reporting Service JRS report URL...

Authorization

LG On-Screen Phone OSP before 4.3.010 allows remote attackers to bypass authorization via a crafted request...

CVE-2015-1497

radexecd.exe in Persistent Systems Radia Client Automation RCA 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465...

Asterisk libcURL HTTP Request Injection (AST-2015-002)

According to its SIP banner, the version of Asterisk running on the remote host is potentially affected by an HTTP request injection vulnerability due to a flaw within the included libcURL library in the 'parseurlandfillconn' function when handling line feeds and carriage returns. A remote...

Unspecified Arbitrary Code Execution Vulnerability in Oracle Solaris Cluster

Oracle Solaris Cluster is a product that provides expanded high availability and disaster recovery capabilities. An unspecified security vulnerability exists in the Oracle Solaris Cluster System management child, which can be exploited by a local attacker to execute arbitrary code by submitting a...

Unspecified Arbitrary Code Execution Vulnerability in Oracle Solaris Cluster (CNVD-2015-00620)

Oracle Solaris Cluster is a product that provides expanded high availability and disaster recovery capabilities. An unspecified security vulnerability exists in the Oracle Solaris Cluster System management child, which can be exploited by a remote attacker to execute arbitrary code by submitting ...

Easy-Chat-Server-3.1

Easy Chat Server contains an overflow condition that is triggered as user-supplied input is not properly validated when handling input passed via the 'username' parameter to the /chat.ghp script. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or...

Xxe

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

CVE-2014-0171

XML external entity XXE vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint...

CVE-2014-100025

Cross-site request forgery CSRF vulnerability in index.php/userdata/insertuser in Savsoft Quiz allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a crafted request...