Xxe

Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not...

CVE-2014-6577

CVE-2014-6577 is an Oracle Database Server issue affecting the XML Developer's Kit for C component. Versions 11.2.0.3/11.2.0.4/12.1.0.1/12.1.0.2 are affected. The vulnerability is described as an XML external entity (XXE) issue in the XML parser that could allow a remote, authenticated user to af...

Exploit for Flash Zero Day Appears in Angler Exploit Kit

The dangerous Angler exploit kit has a new piece of ammunition to use in its attacks: a fresh Adobe Flash zero-day vulnerability. The kit is exploiting the previously unknown vulnerability in several versions of Internet Explorer running on Windows 7 and Windows 8. French security researcher...

java security update

CentOS Errata and Security Advisory CESA-2015:0067 Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System...

CVE-2014-6577: Undefined Security Weakness

Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. NOTE: the previous information is from the January 2015 CPU. Oracle has not...

Important: Red Hat Security Advisory: java-1.7.0-openjdk security update

Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

CVE-2014-4639

EMC Documentum Web Development Kit WDK before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value...

CVE-2014-4637

Open redirect vulnerability in EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2014-4638

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

CVE-2014-4636

Cross-site request forgery CSRF vulnerability in EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations...

CVE-2014-4635

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum Web Development Kit WDK before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum Web Development Kit WDK before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Open redirect

Open redirect vulnerability in EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

Design/Logic Flaw

EMC Documentum Web Development Kit WDK before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value...

CVE-2014-4638

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

CVE-2014-4639

CVE-2014-4639 affects EMC Documentum Web Development Kit (WDK) before 6.8. The issue is insufficient randomness in a Webtop component parameter, enabling remote attackers to predict the parameter and carry out phishing via brute-force attempts. The ESA-2014-180 advisory lists this under multiple ...

EMC Documentum Web Development Kit (WDK) Cross-Site Request Forgery Vulnerability

The EMC Documentum Web Development Kit WDK is a Web development kit. A cross-site request forgery vulnerability exists in the EMC Documentum Web Development Kit WDK, which could be exploited by a remote attacker to perform certain unauthorized actions and gain access to vulnerable applications...

EMC Documentum Web Development Kit (WDK) URL Redirection Vulnerability

The EMC Documentum Web Development Kit WDK is a Web development kit. The EMC Documentum Web Development Kit WDK contains a URL redirection vulnerability that can be exploited by an attacker to construct URLs that contain malicious Web sites, which may be redirected to an attacker-controlled Web...

Unspecified Framework Injection Vulnerability in EMC Documentum Web Development Kit (WDK)

The EMC Documentum Web Development Kit WDK is a Web development kit. An unspecified frame injection vulnerability exists in EMC Documentum Web Development Kit WDK, which can be exploited by attackers to conduct phishing attacks...