sanofi.fr XSS vulnerability

Vulnerable URL: http://www.sanofi.fr/l/fr/fr/search.jsp?Search=asd%22autofocus/onfocus=alert%28%27XSSPOSED%27%29%3E&submitSearch.x;=0&submitSearch.y;=0 Details: Description| Value ---|--- Patched:| Yes, at 08.08.2015 Latest check for patch:| 08.08.2015 23:56 GMT Vulnerability type:| XSS...

sammydress.com XSS vulnerability

Vulnerable URL: http://www.sammydress.com/product175"4488.html?i=0000211149 Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 12:52 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3492 Google Pagerank| 5 VIP...

SOL16903 - Microsoft Schannel vulnerability CVE-2015-1637

1 BIG-IP Edge Client for Windows uses Schannel.dll directly and indirectly through WinINet for HTTPS communication with Microsoft Windows. F5 recommends that users apply the applicable Microsoft update posted at . This link takes you to a resource outside of AskF5, and the third party could remov...

SOL16864 - SSL/TLS RC4 vulnerability CVE-2015-2808

Refer to the FirePass section of the Vulnerability Recommended Actions section. Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be no...

Sql injection

SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter...

CVE-2015-2849

Summary (CVE-2015-2849) : The ANTlabs InnGate firmware (IG3100, InnGate 3.01 E, 3.10 E, 3.10 M, SG 4, SSG 4) contains a SQL injection vulnerability in the main.ant page. The issue arises from the ppli URL parameter; when using HTTPS, a remote attacker can induce arbitrary SQL commands on the unde...

CVE-2015-2849

SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter...

CVE-2014-5406 Hospira LifeCare PCA Infusion System

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

barnesandnoble.com XSS vulnerability

Vulnerable URL: http://www.barnesandnoble.com/mobile/noresults/%27%22%3Ev0raz%3Cbody/onpageshow=%22%26%2397lert%28'XSSPOSED'%29%22%3E Details: Description| Value ---|--- Patched:| Yes, at 24.01.2016 Latest check for patch:| 24.01.2016 12:27 GMT Vulnerability type:| XSS Vulnerability status:|...

trial-sport.ru XSS vulnerability

Vulnerable URL: http://trial-sport.ru/gds.php?q=xss=1=0=0=0';alert/XSSposed///=0from=0to= Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 20:57 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 16001 Google...

CVE-2014-5406: Insufficient Verification of Data Authenticity

The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a 1 drug library, 2 software update, or 3 configuration change, which allows remote attackers to modify settings or medication data via packets on the a TELNET, b HTTP, c HTTPS, or d UPNP...

FreeBSD : ansible -- multiple vulnerabilities (72fccfdf-2061-11e5-a4a5-002590263bf5)

Ansible, Inc. reports : Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2 Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2 %NASLMINLEVEL 70300 C Tenable Networ...

HSTS Missing From HTTPS Server

The remote HTTPS server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and...

Pinterest Fixes Validation Vulnerability in API

Pinterest recently fixed an issue in the API of its web app that could have allowed remote attackers to compromise emails and carry out session hijacking and phishing attacks. Vulnerability Lab researcher Benjamin Kunz Mejri discovered the issue, which is a persistent mail encoding and validation...

CVE-2015-1951

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

Design/Logic Flaw

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

CVE-2015-1951

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation...

CVE-2015-1951

CVE-2015-1951 affects IBM Maximo Asset Management and related products (e.g., Maximo Asset Management Essentials, several Industry Solutions, SmartCloud Control Desk, Tivoli/TAM IT products) as listed in IBM Security Bulletin. The vulnerability arises because HTTPS responses can be cached locally...

Debian Security Advisory DSA 3298-1 (jackrabbit - security update)

It was discovered that the Jackrabbit WebDAV bundle was susceptible to a XXE/XEE attack. When processing a WebDAV request body containing XML, the XML parser could be instructed to read content from network resources accessible to the host, identified by URI schemes such as https or file. Dependi...

Debian DSA-3298-1 : jackrabbit - security update

It was discovered that the Jackrabbit WebDAV bundle was susceptible to a XXE/XEE attack. When processing a WebDAV request body containing XML, the XML parser could be instructed to read content from network resources accessible to the host, identified by URI schemes such as'https' or 'file'...