551 matches found
Deep dive in Lexmark Perceptive Document Filters Exploitation
This post authored by Marcin Noga with contributions from Nick BiasiniIntroductionTalos discovers and releases software vulnerabilities on a regular basis. We don't always publish a deep technical analysis of how the vulnerability was discovered or its potential impact. This blog will cover these...
Trend Micro Threat Discovery Appliance Arbitrary Code Execution Vulnerability (CNVD-2017-06837)
The Trend Micro Threat Discovery Appliance TDA is a threat discovery appliance with integrated cloud security technology from Trend Micro. The appliance provides detection of malicious activity at the network layer, threat management services, and threat analysis and reporting. A security...
CVE-2016-8587
dlppolicyupload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /engptnstores/prod/sensorSDK/data/ or /engptnstores/prod/sensorSDK/backuppol/...
Trend Micro Control Manager cgiShowClientAdm Security Bypass
The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...
Fortinet FortiOS 5.4.1 < 5.4.4 Multiple Vulnerabilities
The remote host is running a version of Fortinet FortiOS that is 5.4.1 or later but prior to 5.4.4. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists in the HTTP evader tool due to improper handling of HTTP content-encoding. An unauthenticated,...
R77.30, R77.20 Security hotfix for DLP and Threat Extraction blades
...
CVE-2016-0895
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity...
CVE-2016-0894
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter...
CVE-2016-0893
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages...
CVE-2016-0892
Cross-site scripting XSS vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2016-0895
CVE-2016-0895 affects EMC RSA Data Loss Prevention 9.6 before SP2 P5, where remote attackers can trigger clickjacking via web-site elements with crafted transparency/opacity. The connected sources confirm the product/version and the vulnerability class but do not provide exploitation details or c...
CVE-2016-0894
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter...
CVE-2016-0894
The CVE affects EMC RSA Data Loss Prevention 9.6 before SP2 P5. A remote authenticated user can bypass object access restrictions by modifying a parameter, indicating an improper access-control validation in the affected component. Remediation: upgrade to EMC RSA DLP 9.6 SP2 P5 or apply the relev...
CVE-2016-0893
CVE-2016-0893 affects EMC RSA Data Loss Prevention 9.6 prior to SP2 P5. The issue allows remote authenticated users to obtain sensitive information by reading error messages, indicating information disclosure through error handling. The provided connected documents confirm the affected product an...
CVE-2016-0895
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity...
Cross site scripting
Cross-site scripting XSS vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention DLP before 12.5.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-9230
The CVE-2014-9230 issue is a cross-site scripting (XSS) vulnerability in the administration console of Symantec Data Loss Prevention (DLP) Enforce Server, prior to version 12.5.2. A remote attacker could inject arbitrary web script or HTML via unspecified vectors in the Enforce Server admin UI. T...
CVE-2015-1485
CVE-2015-1485 is a CSRF vulnerability in the administration console of Symantec Data Loss Prevention (DLP) Enforce Server, prior to version 12.5.2. The issue allows a remote attacker to hijack administrator authentication and perform unauthorized operations through forged requests, as stated in m...
Microsoft ExchangeDLP Cross Site Scripting (MS15-026; CVE-2015-1629)
An elevation of privilege vulnerability exists in Microsoft Exchange Server. The vulnerability is caused when Microsoft Exchange Server does not properly sanitize page content in Outlook Web App. A remote attacker can exploit this issue by modifying certain properties within Outlook Web App and...
