AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

OOME from EAP 6 http management console

It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use this flaw to cause a denial of service...

AS/WildFly: missing X-Frame-Options header leading to clickjacking

It was discovered that the EAP Management Console could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console clickjacking...

The vulnerability of the Avira Management Console allows a hacker to execute arbitrary code.

The vulnerability of the Update Manager service in the Avira Management Console relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Avira Management Console Server HTTP Header Processing Heap Buffer Overflow

A heap buffer overflow vulnerability has been reported in Avira Management Console Server. The vulnerability exists in the way Update Manager Service handles overly long HTTP headers. A remote unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests to the server...

Avira Management Console Memory Misreference Vulnerability

Avira Management Console provides centralized and effective control of Avira security components. A memory misreference vulnerability exists in the Avira Management Console's Update Manager service, which can be exploited by a remote attacker to execute arbitrary code...

CVE-2015-7303

Use-after-free vulnerability in the Update Manager service in Avira Management Console allows remote attackers to execute arbitrary code via a large header...

CVE-2015-7303

CVE-2015-7303 is a use-after-free in Avira Management Console's Update Manager service. By sending oversized HTTP headers, remote attackers can trigger memory reuse and execute arbitrary code, potentially with SYSTEM privileges; authentication is not required per ZDI-15-445. Multiple entries (NVD...

CVE-2015-5693

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

Design/Logic Flaw

adminmessages.php in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to...

Design/Logic Flaw

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

CVE-2015-5693

Symantec Web Gateway (SWG) appliances running before 5.2.2 with database 5.0.0.1277 are affected by CVE-2015-5693 (Traffic Capture EoP). The vulnerability is tied to the hostname/configuration processing path that allows an authenticated, remote attacker to inject commands executed with root priv...

CVE-2015-5692

Symantec Web Gateway (SWG) management console prior to SWG 5.2.2 with DB 5.0.0.1277 is affected by CVE-2015-5692. The issue resides in admin_messages.php, where improper sanitization of uploaded files and a weak sudo configuration allow an authenticated attacker to upload a safe file and leverage...

CVE-2015-6548

Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5690

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."...

CVE-2015-5693

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

2.2: API command injection vulnerability

A command injection flaw was found in the OpenShift Origin Management Console. A remote, authenticated user permitted to send requests to the Broker could use this flaw to execute arbitrary commands with elevated privileges on the Red Hat OpenShift server...

(0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP headers by the Update Manager service. By sending overly...

Symantec Endpoint Protection Manager Arbitrary File Read Vulnerability

Symantec Endpoint Protection Manager SEPM is a suite of enterprise-grade virus protection software from Symantec USA. The software protects against malicious attacks such as viruses, worms, and Trojan horses. SEPM 12.1-RU6-MP1 A security vulnerability exists in the action handler in the managemen...