No Charset in Content-Type Header

Overview Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standa...

macclesfield-express.co.uk XSS vulnerability

Vulnerable URL: http://www.macclesfield-express.co.uk/whats-on/manchester/%22%3E%3Csvg-onload%3Dprompt%28-XSSPOSED-%29%3E/anytime/?query=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:44...

Threat Outbreak Alert RuleID18181: Email Messages Distributing Malicious Software on September 23, 2015

Medium Alert ID: 41156 First Published: 2015 September 23 12:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18181 may contain the following files: Name ...

Design/Logic Flaw

The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary physical memory locations and gain privileges via a 0x00000ffd ioctl call...

VBox Satellite Express Arbitrary Write Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL:...

VBox Satellite Express 2.3.17.3 - Arbitrary Write Vulnerability

A vulnerability within the ndvbs module allows an attacker to inject memory they control into an arbitrary location they define. This vulnerability can be used to overwrite function pointers in HalDispatchTable resulting in an elevation of privilege. suffers from code execution, and local file...

Satellite Express Protocol Elevation of Privilege Vulnerability

Satellite Express Protocol is a satellite expression protocol. An elevation of privilege vulnerability exists in Satellite Express Protocol. An attacker could exploit this vulnerability to gain privileges...

VBox Satellite Express 2.3.17.3 - Arbitrary Write

VBox Satellite Express 2.3.17.3 - Arbitrary Write KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL:...

VBox Satellite Express 2.3.17.3 - Arbitrary Write

KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2015-005.txt 1...

VBox Satellite Express Arbitrary Write Privilege Escalation

Vulnerability Details Affected Vendor: VBox Communications Affected Product: Satellite Express Protocol Affected Version: 2.3.17.3 Platform: Microsoft Windows XP SP3, Microsoft Windows 7 x86 CWE Classification: CWE-123: Write-what-where condition Impact: Arbitrary Code Execution Attack vector:...

express.com XSS vulnerability

Vulnerable URL: http://www.express.com/browse/search.jsp?q="-confirm/XSSPOSED/-" Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5263 Google Pagerank| 5 VI...

Hackable HTTP proxy: Toxy

toxy is a fully programmatic and hackable HTTP proxy to simulate server failure scenarios and unexpected network conditions It was mainly designed for fuzzing/evil testing purposes, when toxy becomes particularly useful to cover fault tolerance and resiliency capabilities of a system, especially ...

Unauthorized Access Vulnerability in Multiple Dedicated Micros DVR Products

Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense and DS2 are hard disk recorders from Dedicated Micros UK. A security vulnerability exists in several Dedicated Micros products, allowing remote attackers to exploit the vulnerability for unauthorized access to the devices...

Threat Outbreak Alert RuleID16970: Email Messages Distributing Malicious Software on July 27, 2015

Medium Alert ID: 40165 First Published: 2015 July 27 21:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16970 may contain the following files: Name | Siz...

SEC Consult SA-20150716-0 :: Permanent Cross-Site Scripting in Oracle Application Express

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150716-0 ======================================================================= title: Permanent Cross-Site Scripting product: Oracle Application Express vulnerable version: All versions prior to...

Unspecified Vulnerability in Oracle Database Application Express Component (CNVD-2015-04808)

Oracle Database is a large database of commercial nature. A security vulnerability exists in the Oracle Database Application Express component that allows an authenticated user to affect system availability...

Unspecified Vulnerability in Oracle Database Application Express Component (CNVD-2015-04809)

Oracle Database is a large database of commercial nature. A security vulnerability exists in the Oracle Database Application Express component that allows an authenticated user to affect system availability...

Unspecified Vulnerability in Oracle Database Application Express Component (CNVD-2015-04810)

Oracle Database is a large database of commercial nature. A security vulnerability exists in the Oracle Database Application Express component that allows an authenticated user to compromise system integrity, confidentiality...

Oracle Application Express Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications title: Permanent Cross-Site Scripting product: Oracle Application Express vulnerable version: All versions prior to 4.2.3.00.08 fixed version: 4.2.3.00.08 CVE number: CVE-2015-2655 impact: high homepage: https://apex.oracle.com/i/index.ht...

Oracle Database Multiple Vulnerabilities (July 2015 CPU)

The remote Oracle database server is missing the July 2015 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities in the following components : - Application Express CVE-2015-2655, CVE-2015-2585, CVE-2015-2586 - Core RDBMS CVE-2015-0468 - Java VM CVE-2015-2629 - Oracle...