CVE-2015-4190

CVE-2015-4190 affects Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1_vortex on Cloud Portal appliances. The root cause is a design flaw/default host keys that enable a man-in-the-middle attack, allowing an unauthenticated remote attacker to modify data during login or data exchange via u...

CVE-2015-4190

Cisco Cloud Portal in Cisco Prime Service Catalog 9.4.1vortex on Cloud Portal appliances allows man-in-the-middle attackers to modify data via unspecified vectors, aka Bug ID CSCuh19683...

Cisco Cloud Portal Default SSH HOST Key Man-in-the-Middle Attack Vulnerability

Cisco Cloud Portal is a cloud portal for data center services. Cisco Cloud Portal has a security vulnerability due to the system using a default host key for SSH communication. A remote attacker could modify the target system data through a man-in-the-middle attack...

IBM Marketing Operations Arbitrary File Upload Vulnerability

IBM Marketing Operations formerly known as IBM Unica Marketing Operations is a suite of marketing management software from the American company IBM. The software supports streamlining of production processes, tracking of budgets and expenditures, and improved teamwork. IBM Marketing Operations...

Design/Logic Flaw

IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2 allows remote authenticated users to upload arbitrary GIFAR files, and consequently modify data, via unspecified vectors...

CVE-2014-8887

CVE-2014-8887 affects IBM Marketing Operations 7.x/8.x (before 8.5.0.7.2), 8.6.x (before 8.6.0.8), 9.0.x (before 9.0.0.4.1), 9.1.0.x (before 9.1.0.5), and 9.1.1.x (before 9.1.1.2). A remote authenticated attacker can upload arbitrary GIFAR files and modify data via unspecified vectors. The root c...

IBM Security SiteProtector System SQL Injection Vulnerability

The IBM Security SiteProtector System is a centralized management system that unifies the management and analysis of network, server and endpoint security agents and devices. A SQL injection vulnerability exists in IBM Security SiteProtector System, which allows remote attackers to exploit the...

Multiple SQL Injection Vulnerabilities in WordPress GigPress Plugin 'handlers.php'

WordPress is a blogging platform developed using the PHP language that allows users to set up their own weblogs on servers that support PHP and MySQL databases.GigPress is a real-time gig listing and management plugin for musicians and other performers. Multiple SQL injection vulnerabilities exis...

WordPress Wp Image Zoom Plugin - SQL Injection

Because of this vulnerability, attackers can compromise the application, access or modify data. zoom.php id parameter is vulnerable. Solution Update plugin...

Nodes Studio CMS Information Disclosure Vulnerability

Nodes Studio CMS is a content management system. Nodes Studio CMS has an unspecified security vulnerability that allows remote attackers to obtain sensitive cookie information, take control of the application, and access or modify data...

KPPW最新版SQL注入漏洞，修补不严

简要描述： KPPW最新版SQL注入漏洞，修补不严 详细说明： 1.看了http://wooyun.org/bugs/wooyun-2010-086216。这篇帖子，正巧也在审计KPPW，也就去看了用一下最新版对于爆出问题的修补方式。最新版为了防止该漏洞，添加了一个验证。 if$gUserInfo'uid' != $pk'uid' kekezu::showmsg'无权操作',NULL,NULL,NULL,'error'; return false; 2.$gUserInfo'uid'是用户id，是我们不可控的。所以这里不能再用xfkxfk大牛的方法构造uid了。那么我们再看一下save函...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The vulnerability of the libuno-cli-cppuhelper1.0-cil package within the office software suite OpenOffice is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability allows a remote attacker to gain access to confidential data, compromise its...

The vulnerability of the SUSE Linux Enterprise operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the glibc-locale-32bit package in the SUSE Linux Enterprise operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

The vulnerability of the Windows operating system, which allows a remote attacker to escalate their privileges

The Microsoft Windows operating system contains a vulnerability related to improper verification and application of impersonation levels. This allows attackers to bypass security checks and elevate their privileges, including gaining administrator account information. If exploited successfully,...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libxml2-devel-2.4.19 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...

Unspecified Vulnerability in Oracle Fusion Middleware WebCenter Portal Component (CNVD-2015-02540)

Oracle Fusion Middleware is Oracle's suite of business innovation platforms for enterprise and cloud environments, of which Oracle WebCenter Portal is a component that seamlessly integrates portals with enterprise applications. A security vulnerability exists in the Portlet Services subcomponent ...

Wordpress Video Gallery SQL Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. A SQL injection vulnerability exists in Wordpress Video Gallery. An attacker can exploit this vulnerability to compromise the application, access or modify data...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...

IBM WebSphere DataPower XC10 appliance session hijacking vulnerability

The IBM WebSphere DataPower XC10 Appliance is a solution that combines the powerful DataPower hardware platform with IBM's distributed caching technology. A security vulnerability exists in the IBM WebSphere DataPower XC10 Appliance that allows remote attackers to hijack arbitrary user sessions t...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...