5462 matches found
JavaScript Percent-Encoding Obfuscation
Although various security products provide coverage against many web vulnerabilities, such as ActiveX exploits, these known exploits could potentially bypass security products by using JavaScript obfuscation techniques.An example of such a technique is percent-encoding, also known as URL encoding...
CVE-2014-3370
Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...
CVE-2014-3370
CVE-2014-3370 affects Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Software predating X8.1.1. A vulnerability in the SIP processing/module allows remote attackers to trigger a denial of service (device reload) via crafted SIP packets (Bug IDs CSCum60442, CSCum60447). D...
CVE-2014-6936
The IDS 2013 aka de.mobileeventguide.ids2013 application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6936
The IDS 2013 aka de.mobileeventguide.ids2013 application 1.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-6936
The CVE-2014-6936 entry concerns the IDS 2013 Android application (version 1.21) that fails to verify X.509 certificates from SSL servers, enabling potential MITM attacks to spoof servers and exfiltrate data. The vulnerability is described across multiple sources (NVD/NVD-derived records) as a ce...
CVE-2014-3390
The Virtual Network Management Center VNMC policy implementation in Cisco ASA Software 8.7 before 8.71.14, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and...
CVE-2014-3402
The authentication-manager process in the web framework in Cisco Intrusion Prevention System IPS 7.08E4 and earlier in Cisco Intrusion Detection System IDS does not properly manage user tokens, which allows remote attackers to cause a denial of service temporary MainApp hang via a crafted...
Authentication flaw
The authentication-manager process in the web framework in Cisco Intrusion Prevention System IPS 7.08E4 and earlier in Cisco Intrusion Detection System IDS does not properly manage user tokens, which allows remote attackers to cause a denial of service temporary MainApp hang via a crafted...
Design/Logic Flaw
The Virtual Network Management Center VNMC policy implementation in Cisco ASA Software 8.7 before 8.71.14, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and...
CVE-2014-3402
CVE-2014-3402 affects Cisco IPS/IDS web framework: authentication-manager mismanages user tokens, enabling an authenticated remote attacker to trigger a DoS (MainApp hang) via a crafted request to the management interface. Valid for IPS 7.0(8)E4 and earlier. Exploitation requires existing authent...
CVE-2014-3390
CVE-2014-3390 affects Cisco ASA with VNMC policy code. Authenticated, local attackers can exploit insufficient input sanitization in the VNMC policy to gain the root shell on the underlying Linux system. Affected software versions are Cisco ASA 8.7 prior to 8.7(1.14), 9.2 prior to 9.2(2.8), and 9...
CVE-2014-3390
The Virtual Network Management Center VNMC policy implementation in Cisco ASA Software 8.7 before 8.71.14, 9.2 before 9.22.8, and 9.3 before 9.31.1 allows local users to obtain Linux root access by leveraging administrative privileges and executing a crafted script, aka Bug IDs CSCuq41510 and...
Yahoo Confirms Infected Servers Unrelated to Shellshock
Yahoo CISO Alex Stamos refuted claims made by a Louisiana security company that a number of Yahoo servers had been compromised by Romanian hackers using Shellshock exploits against the vulnerability in Bash. Stamos said three Yahoo Sports API servers were infected with malware by hackers looking...
CVE-2014-3400
Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344...
Code injection
Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344...
CVE-2014-3400
Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344...
CVE-2014-3400
CVE-2014-3400 affects Cisco WebEx Meetings Server. Remote authenticated users can obtain sensitive information by reading logs. The description ties the issue to Bug IDs CSCuq36417 and CSCuq40344. No specific root cause, affected versions, exploit details, or remediation are provided in the conne...
GNU Bash shell executes commands in exported functions in environment variables
Overview GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution. Description UPDATE: New CVE-IDs added for incomplete patches. Additional resources added and vendor patch information updated.CWE-78: OS Command Injection Bash supports exporting of...