CVE-2017-3948

Cross Site Scripting XSS in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint DLP Endpoint 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session...

CVE-2017-3948

Summary: CVE-2017-3948 is a Cross Site Scripting (XSS) vulnerability in the IMG Tags of the ePO extension for McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x. The underlying issue is an XSS in IMG Tags that allows an authenticated user to inject arbitrary web script or HTML via malicio...

Deep dive in Lexmark Perceptive Document Filters Exploitation

This post authored by Marcin Noga with contributions from Nick BiasiniIntroductionTalos discovers and releases software vulnerabilities on a regular basis. We don't always publish a deep technical analysis of how the vulnerability was discovered or its potential impact. This blog will cover these...

Trend Micro Threat Discovery Appliance Arbitrary Code Execution Vulnerability (CNVD-2017-06837)

The Trend Micro Threat Discovery Appliance TDA is a threat discovery appliance with integrated cloud security technology from Trend Micro. The appliance provides detection of malicious activity at the network layer, threat management services, and threat analysis and reporting. A security...

CVE-2016-8587

dlppolicyupload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /engptnstores/prod/sensorSDK/data/ or /engptnstores/prod/sensorSDK/backuppol/...

Trend Micro Control Manager cgiShowClientAdm Security Bypass

The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...

Fortinet FortiOS 5.4.1 < 5.4.4 Multiple Vulnerabilities

The remote host is running a version of Fortinet FortiOS that is 5.4.1 or later but prior to 5.4.4. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists in the HTTP evader tool due to improper handling of HTTP content-encoding. An unauthenticated,...

R77.30, R77.20 Security hotfix for DLP and Threat Extraction blades

...

CVE-2016-0895

EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity...

CVE-2016-0894

EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter...

CVE-2016-0893

EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages...

CVE-2016-0892

Cross-site scripting XSS vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0895

CVE-2016-0895 affects EMC RSA Data Loss Prevention 9.6 before SP2 P5, where remote attackers can trigger clickjacking via web-site elements with crafted transparency/opacity. The connected sources confirm the product/version and the vulnerability class but do not provide exploitation details or c...

CVE-2016-0894

The CVE affects EMC RSA Data Loss Prevention 9.6 before SP2 P5. A remote authenticated user can bypass object access restrictions by modifying a parameter, indicating an improper access-control validation in the affected component. Remediation: upgrade to EMC RSA DLP 9.6 SP2 P5 or apply the relev...

CVE-2016-0893

CVE-2016-0893 affects EMC RSA Data Loss Prevention 9.6 prior to SP2 P5. The issue allows remote authenticated users to obtain sensitive information by reading error messages, indicating information disclosure through error handling. The provided connected documents confirm the affected product an...

CVE-2016-0894

EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter...

CVE-2016-0895

EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity...

Cross site scripting

Cross-site scripting XSS vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention DLP before 12.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-9230

The CVE-2014-9230 issue is a cross-site scripting (XSS) vulnerability in the administration console of Symantec Data Loss Prevention (DLP) Enforce Server, prior to version 12.5.2. A remote attacker could inject arbitrary web script or HTML via unspecified vectors in the Enforce Server admin UI. T...

CVE-2015-1485

CVE-2015-1485 is a CSRF vulnerability in the administration console of Symantec Data Loss Prevention (DLP) Enforce Server, prior to version 12.5.2. The issue allows a remote attacker to hijack administrator authentication and perform unauthorized operations through forged requests, as stated in m...