CVE-2018-0205

A vulnerability in the User Provisioning tab in the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by...

OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data...

Design/Logic Flaw

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

CVE-2017-4931

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

CVE-2017-4931

VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious conten...

Ektron Content Management System Cross-Site Scripting Vulnerability

Ektron Content Management System is an enterprise-level Web content management system from Ektron, Inc. A cross-site scripting vulnerability exists in the Ektron Content Management System, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtai...

OpenText Documentum Content Server SQL Injection

!/usr/bin/env python import socket import sys from os.path import basename from dctmpy.docbaseclient import DocbaseClient from dctmpy.obj.typedobject import TypedObject CIPHERS = "ALL:aNULL:!eNULL" def usage: print "usage:\n\t%s host port user password" % basenamesys.argv0 def main: if lensys.arg...

Reverse Safety series: Use After Free vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword Thinking the next step is to write a use after free small summary, just happened to be the nearest Lake Gordon Cup 2016 the one.---- game Use the use after free can be out. This title is their first in more formal competitions, make pwn title, do this question of time spent a lot, t...

CVE-2016-2373

A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability...

phpMyAdmin path traversal vulnerability (CNVD-2016-12845)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A path traversal vulnerability exists in phpMyAdmin,...

ntp: incomplete checks in ntp_crypto.c

It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntpcrypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially...

WWW File Share Pro Remote Denial of Service Vulnerability

WWW File Share Pro is an easy-to-use file sharing server. A denial of service vulnerability exists in WWW File Share Pro 7.0 and earlier versions, which allows attackers to send malicious data and cause the server to crash...

android studio v2.1.1前旧版本会导致恶意数据访问

No description provided by source...

CakePHP Framework 3.2.4 IP Spoofing

http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt ============================================= - Release date: 12.05.2016 - Discovered by: Dawid Golunski - Severity: Medium ============================================= I. VULNERABILITY ------------------------- CakePHP...

ntp: incomplete checks in ntp_crypto.c

It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntpcrypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially...

ntp: incomplete checks in ntp_crypto.c

It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntpcrypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially...

MediaWiki wikilink cross-site scripting vulnerability

MediaWiki is a suite of free and freely available web-based wiki engines that can be used to deploy in-house knowledge management and content management systems. MediaWiki fails to adequately filter wikilinks, allowing remote attackers to exploit vulnerabilities to inject malicious scripts or HTM...

WSO2 Identity Server Cross-Site Scripting Vulnerability

WSO2 Identity Server is an open source identity service that supports Information Cards, OpenID and XACML identity frameworks. WSO2 Identity Server suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code,...

OpenSSL Heartbleed 漏洞 (心脏出血)

OpenSSL“心脏出血”漏洞是一个非常严重的问题。这个漏洞使攻击者能够从内存中读取多达64 KB的数据。一些安全研究员表示：无需任何特权信息或身份验证，我们就可以从我们自己的（测试机上）偷来X.509证书的私钥、用户名与密码、聊天工具的消息、电子邮件以及重要的商业文档和通信等数据。这一切是如何发生的呢？让我们一起从代码中一探究竟吧。0x01 Bug请看ssl/dlboth.c，漏洞的补丁从这行语句开始：int dtls1processheartbeatSSL s unsigned char p = &s-s3-rrec.data0, pl; unsigned short hbtype;...

CUPS Sample Engine Cross-Site Scripting Vulnerability

CUPS is a Universal Unix Printing System, a cross-platform printing solution for Unix environments, based on the Internet Printing Protocol, providing most PostScript and raster printer services. A cross-site scripting vulnerability exists in the CUPS sample engine, which allows remote attackers ...