CVE-2016-0218

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security...

PT-2016-7673

Name of the Vulnerable Software and Affected Versions SIMATIC S7-300 CPU family versions all SIMATIC S7-400 PN/DP V6 and below CPU family versions all SIMATIC S7-400 PN/DP V7 CPU family versions all SIMATIC S7-400 V6 and earlier CPU family versions all SIMATIC S7-400 V7 CPU family versions all...

Adobe RoboHelp Cross-Site Scripting Vulnerability

Adobe RoboHelp is a software from Adobe USA is a professional authoring tool that can be used to develop help systems, eLearning content, knowledge bases, and programs and step-by-step software. A cross-site scripting vulnerability exists in Adobe RoboHelp, which could be exploited by an attacker...

U.S. Dept Of Defense: Open redirect vulnerability in a DoD website

An open redirect vulnerability was found on a Department of Defense website which may trick a web user into being redirected to fake websites which may steal data or credentials usernames and passwords, or trick users into installing malware. @niwasaki was able to demonstrate this vulnerability b...

MyBB has multiple vulnerabilities (CNVD-2016-11618)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.8 including: SQL injectio...

MyBB has multiple vulnerabilities (CNVD-2016-11626)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.8 including: SQL injectio...

MyBB has multiple vulnerabilities (CNVD-2016-11609)

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. Multiple security vulnerabilities exist in versions of MyBB prior to 1.8.6, including SQL injectio...

Puppet Enterprise Web Interface Open Redirect

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt + ISR: ApparitionSec Vendor: ============== www.puppet.com Product: ================================ Puppet Enterprise Web Interface Version...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2016-09989)

Open-Xchange AppSuite OX AppSuite is a suite of Web-based cloud desktop environments from Open-Xchange, Inc. in the United States. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange AppSuite due to a failu...

PT-2025-41460

Name of the Vulnerable Software and Affected Versions AVTECH devices affected versions not specified Description AVTECH devices that include the CloudSetup.cgi management endpoint are susceptible to authenticated OS command injection. The exefile parameter within the ''CloudSetup.cgi'' endpoint i...

IBM Security Access Manager Security Bypass Vulnerability (CNVD-2016-08438)

IBM Security Access Manager is a security access manager from IBM USA. A security bypass vulnerability exists in IBM Security Access Manager for Web that originates from the program's use of inadequate account lockout settings. A remote attacker could exploit the vulnerability to brute-force brea...

Android Banking Trojan First to Gain Root Privileges

Developers behind an Android banking Trojan have fortified the malware with an exploit to help it gain root privileges; this is the first time a mobile banker that tries to obtain root privileges has been seen in the wild. Researchers detected the Tordow Trojan in February, but attackers have...

Multiple Cross-Site Scripting Vulnerabilities in Geeklog IVYWE

geeklog is an open source content management system CMS. Multiple cross-site scripting vulnerabilities exist in Geeklog IVYWE. Because the program fails to properly perform user-supplied input, an attacker could exploit the vulnerabilities to execute arbitrary script code in a trusted user's...

Unspecified Cross-Site Scripting Vulnerability in OSSEC Web UI

OSSEC's Web UI is using an open source web interface OSSEC HIDS Security. An unspecified cross-site scripting vulnerability exists in the OSSEC Web UI. An attacker may be able to exploit the vulnerability to execute arbitrary script code in a trusted user's browser at an affected site. Allowing a...

Multiple HTML Injection Vulnerabilities in Fortinet FortiVoice

The Fortinet FortiVoice phone system is designed to provide a simple, affordable and user-friendly package for handling intelligent calls. Multiple HTML injection vulnerabilities exist in Fortinet FortiVoice. Because the program fails to properly filter user-supplied input, an attacker could...

Amazon Same Day Credential Shipping

FireEye has identified a campaign involving phishing websites that appear as legitimate Amazon sites. Amazon is the largest online retailer and threat actors frequently target its customers. In this attack, a person browsing the internet would be directed to authentic looking – yet fake – Amazon...

Imgur: Reflected XSS in m.imgur.com

There is a reflected XSS vulnerability in https://m.imgur.com as shown below: https://m.imgur.com/account/testcatplzignore%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3E/messages It appears that the username field in the url does not sanitize angle bracket characters on the mobile version...

Acer Portal app for Android SSL Certificate Validation Vulnerability

Acer Portal app for Android is a suite of Android-based portals for registering Acer products from Acer. A security vulnerability exists in Acer Portal app for Android versions 3.9.3.2003 through 3.9.3.2006 that can be exploited by remote attackers to impersonate Acer Cloud and obtain user...

The vulnerability of Trillian software allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Cerulean Studios Trillian due to the lack of verification of SSL certificates during MSN authentication. Exploiting this vulnerability allows malicious actors operating remotely to obtain MSN credentials by using a “man-in-the-middle” attack and replacing the SSL...

python-django-horizon: XSS in client side template

A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...