CVE-2015-2804

CVE-2015-2804 affects Alcatel-Lucent OmniSwitch models (6450, 6250, 6850E, 9000E, 6400, 6855) with AOS firmware before 6.6.4.309.R01 and 6.6.5.x before 6.6.5.80.R02. The vulnerability is weak session identifier generation in the management web interface, enabling remote session hijacking via brut...

Apache Sling API and Sling Servlets Cross-Site Scripting Vulnerabilities

Apache Sling API is the United States Apache Apache Software Foundation's set of frameworks for building Web applications. Apache Sling Servlets Post is one of the container. Apache Sling API and Sling Servlets have a cross-site scripting vulnerability. Allow remote attackers to exploit the...

CVE-2015-3090

creationtimestamp| type| source ---|---|--- 2015-05-27 07:14:54+00:00| seen| MISP/55656ec4-8154-41ea-a1ce-42c7950d210b 2015-06-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/37368 2015-06-25 10:59:48+00:00| seen| MISP/558bdeda-4ff0-463c-aac5-4b9e950d210b 2018-05-29...

Sendio ESP Information Disclosure Vulnerability

Exploit for jsp platform in category web applications 1. Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of...

Sendio ESP - Information Disclosure

Sendio ESP - Information Disclosure 1. Advisory Information Title: Sendio ESP Information Disclosure Vulnerability Advisory ID: CORE-2015-0010 Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability Date published: 2015-05-22 Date of last update:...

Google Chrome Input Validation Vulnerability (CNVD-2015-03346)

Google Chrome on Android is a web browser developed by the American company Google Google for the Android platform. A security vulnerability exists in the android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java file in versions of Google Chrome prior to 43.0.2357.65 on the Android...

Microsoft Windows DNS Server Spoofing - Ver2 (CVE-2007-3898)

There exits a vulnerability in Microsoft Windows DNS Server. The flaw is caused by predictable transaction identifiers in DNS requests generated. A remote attacker may leverage this vulnerability to use spoofed DNS responses to poison the DNS cache on the target system...

Trend Micro ScanMail for Microsoft Exchange Authentication Bypass Vulnerability

Trend Micro ScanMail for Microsoft Exchange is a virus scanning program for Exchange mail servers. Trend Micro ScanMail for Microsoft Exchange SMEX prior to 10.2 Hot Fix Build 3318 and prior to 11.0 Hot Fix Build 4180 uses a guessable random number generator to generate the session ID of the WEB...

Huawei SEQ Analyst suffers from multiple cross-site scripting vulnerabilities

Huawei SEQ Analyst is a solution with proven big data storage and analysis capabilities. Huawei SEQ Analyst fails to properly filter multiple parameters, which can be exploited by a remote attacker to construct malicious URIs and trick users into parsing them, which can obtain sensitive cookies,...

Novell ZENworks Session ID Disclosure Vulnerability

Novell ZENworks is a suite of software that supports automated IT management and business process management across resources within an organization. A security vulnerability in the Rtrlet.class class of Novell ZENworks allows remote attackers to submit a special POST request to obtain sensitive...

GLSA-201504-04 : Xen: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201504-04 Xen: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact : A local attacker could possibly cause a Denial of Service...

CVE-2015-1114

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Design/Logic Flaw

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

Code injection

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

CVE-2015-1110

The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data...

CVE-2015-1114

The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app...

GLSA-201406-11 : libXfont: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-11 libXfont: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libXfont. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could use a specially...

SUSE-SU-2015:0541-1 Security update for openssl

OpenSSL was updated to fix various security issues. Following security issues were fixed: - CVE-2015-0209: A Use After Free following d2iECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client...

Python: Multiple vulnerabilities

Background Python is an interpreted, interactive, object-oriented programming language. Description Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact A context-dependent attacker may be able to execute arbitrary code or...