NewStatPress <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

An insufficient user input validation of HTTP-Header: "Referer" results in a persistent XSS in the WordPress admin-panel. An attacker may be able to access any cookies, session tokens or other sensitive information retained by the browser and used with that site...

PT-2015-4520

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.0 through 6.0.0.11 IBM WebSphere Commerce versions 7.0 before 7.0.0.8 Cumulative iFix 2 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attack...

Netgear Prosafe VPN Firewalls - Multiple vulnerabilities

About Encripto AS ================= Encripto is a Norwegian company which provides specialized services within IT-security. Our core expertise is security testing, network security monitoring and training. Encripto is committed to information security. We do research to discover trends, new...

CVE-2015-4198

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

Cross site scripting

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

CVE-2015-4198

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

PT-2015-6454

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA versions 8.5.0-497 Description A cross-site scripting XSS issue exists in the web framework, allowing remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header. Recommendations For...

CVE-2015-4198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web framework on Cisco Web Security Appliance WSA devices with software 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified HTTP header, aka Bug ID CSCuu24409...

Cisco Web Security Appliance Web Framework HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could introduce arbitrary code into the web interface. The vulnerability is due to insufficient validation of user input before it is used...

CVE-2015-0770

The vulnerability CVE-2015-0770 affects Cisco TelePresence TC software on the SX20 Integrator C platform, specifically TC 6.x before 6.3.4 and 7.x before 7.3.3. The root cause is improper handling of HTTP requests leading toCRLF injection and HTTP response splitting, allowing an unauthenticated, ...

PT-2015-1604

Name of the Vulnerable Software and Affected Versions Cisco TelePresence TC versions 6.x through 6.3.3 Cisco TelePresence TC versions 7.x through 7.3.2 Description The issue is related to a CRLF injection vulnerability that exists due to insufficient input validation. This allows remote attackers...

IBM Watson XSS / Open Redirect

Vulnerability type: Cross-site Scripting & Redirect Vendor: www.ibm.com Product: IBM Watson Cloud Computing SaaS Cognea Product Link: http://www.ibm.com/smarterplanet/us/en/ibmwatson/ Credit: Jerold Hoong The logout.jsp page function of the IBM Watson Cognea SaaS application is vulnerable to...

CVE-2014-0999

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header...

PT-2015-3605

Name of the Vulnerable Software and Affected Versions Sendio versions prior to 7.2.4 Description The issue allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header, as the session identifier is included in URLs in...

CVE-2014-0999: Exposure of Sensitive Information to an Unauthorized Actor

Sendio before 7.2.4 includes the session identifier in URLs in emails, which allows remote attackers to obtain sensitive information and hijack sessions by reading the jsessionid parameter in the Referrer HTTP header...

Crlf injection

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

CVE-2015-0733

Cisco Headend System Release Digital Broadband Delivery System is affected by a CRLF injection vulnerability in the HTTP Header Handler, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response-splitting attacks (potentially enabling XSS). The issue, tracked as CVE-201...

CVE-2015-0733

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...

PT-2015-4848

Name of the Vulnerable Software and Affected Versions Cisco Headend System Release affected versions not specified Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting XSS attacks via a crafted request...

CVE-2015-0733: Improper Neutralization of CRLF Sequences in HTTP Headers

CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting XSS attacks, via a crafted request, aka Bug ID...