Information disclosure

The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka Bug IDs CSCuq42336, CSCuq76853, CSCuq76873, and CSCuq45383...

CVE-2014-3342

The CVE-2014-3342 issue affects Cisco IOS XR CLI, allowing an authenticated, remote attacker to disclose sensitive information through specific CLI commands due to insufficient data protection. Cisco’s advisory states exploitation requires authentication and software updates have been released to...

Cross site request forgery (csrf)

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page...

CVE-2014-0153

CVE-2014-0153 affects oVirt REST API prior to the 3.4.1/3.4.x updates, where session IDs are stored in HTML5 local storage. The underlying risk is that an attacker could read a user’s session ID from local storage via a crafted web page, leading to potential confidentiality impact. Affected softw...

CVE-2014-3351

Cisco Intelligent Automation for Cloud aka Cisco Cloud Portal does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380...

CVE-2014-3351

Cisco Intelligent Automation for Cloud aka Cisco Cloud Portal does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380...

Session fixation

Cisco Intelligent Automation for Cloud aka Cisco Cloud Portal does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, aka Bug IDs CSCuh87398 and CSCuh87380...

CVE-2014-3344

CVE-2014-3344 affects Cisco Transport Gateway for Smart Call Home (TG-SCH) 4.0. Multiple cross-site scripting (XSS) flaws exist in the web framework, allowing remote attackers to inject arbitrary web scripts or HTML via unspecified parameters. Root cause cited: insufficient input validation in th...

AlienVault Releases Intrusion Detection Systems (IDS) Best Practices

Network security practitioners rely heavily on intrusion detection systems IDS to identify malicious activity on their networks by examining network traffic in real time. IDS are available in Network NIDS and Host HIDS forms, as well as for Wireless WIDS. Host IDS is installed via an agent on the...

Directory traversal

Directory traversal vulnerability in 1 Splunk Web or the 2 Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. dot dot in a URI, related to search ids...

CVE-2014-5197

Directory traversal vulnerability in 1 Splunk Web or the 2 Splunkd HTTP Server in Splunk Enterprise 6.1.x before 6.1.3 allows remote authenticated users to read arbitrary files via a .. dot dot in a URI, related to search ids...

Tridium Niagara AX Web Server < 3.5.40.3 / 3.6 < 3.6.47.3 Multiple Vulnerabilities

Binary data 8348.prm...

OpenJDK: missing randomization of JNDI DNS client query IDs (JNDI, 8030731)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality and integrity via vectors related to JNDI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Customer Voice Portal CVP allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug IDs CSCuh61711, CSCuh61720, CSCuh61723, CSCuh61726, CSCuh61727, CSCuh61731, and CSCuh61733...

Heap overflow

Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467...

Buffer overflow

The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463...

CVE-2014-3311

Cisco WebEx Meetings Client vulnerability CVE-2014-3311 is a heap-based buffer overflow in the file-sharing feature of the WebEx Meetings Client used with WebEx Meetings Server and WebEx Meeting Center. The root cause is improper bounds checking during data transfer, allowing an unauthenticated r...

CVE-2014-3311

Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467...

CVE-2014-3297

Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser history, aka Bug...