CVE-2017-15532: Improper Limitation of a Pathname to a Restricted Directory

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack also known as directory traversal. These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Google to Block Third-Party Software from Injecting Code into Chrome Browser

To improve performance and reduce crashes caused by third-party software on Windows, Google Chrome, by mid-2018, will no longer allow outside applications to run code within its web browser. If you are unaware, many third-party applications, like accessibility or antivirus software, inject code...

Apple iPhone X Face ID Fooled by a Mask

Apple’s Face ID technology, the centerpiece biometric authentication mechanism for the iPhone X, has been cracked a little more than a week after it was introduced to the public. Researchers from Vietnamese security company Bkav demonstrated that they could fool the technology to unlock the phone...

Trend Micro InterScan Messaging Security modTMCSS Command Injection (CVE-2017-11391; CVE-2017-11394)

A command injection vulnerability exists in Trend Micro InterScan Messaging Security virtual appliance. The vulnerability is due to improper validation of request parameters within the modTMCSS Proxy functionality. A remote, authenticated attacker could exploit the vulnerability by sending a...

Cisco Spark Messaging Software HTML Injection Vulnerability

Cisco Spark Messaging Software is a collaboration service solution from Cisco. The program by providing a virtual space, so that teams in any location can work together, call and video, and can discuss issues, storage team files and documents. A cross-site scripting vulnerability exists in the We...

CVE-2017-12269

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

Cross site scripting

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

CVE-2017-12269

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

CVE-2017-12269

CVE-2017-12269 affects the web UI of Cisco Spark Messaging Software. The issue is stored XSS caused by insufficient input validation in the web UI, allowing an authenticated, remote attacker to inject XSS content. A successful exploit could force a user to execute attacker-specified code or leak ...

PT-2017-12444

Name of the Vulnerable Software and Affected Versions Cisco Spark Messaging Software affected versions not specified Description A stored cross-site scripting XSS attack could be performed by an authenticated, remote attacker due to insufficient input validation in the web UI. An attacker could...

CVE-2017-12269: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

Cisco Spark Messaging Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

Android messaging DoS

The vulnerability of the Android operating system’s messaging mechanism is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ArchestrA Wonderware Logger Buffer Overflow

The vulnerability of the messaging system between components in ArchestrA Wonderware ArchestrA Logger arises due to buffer overflow on the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of a high-priority account...

Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery Vulnerability

Exploit for multiple platform in category web applications Exploit Title: CSRF Date: August 9, 2017 Software Link: https://www.symantec.com/products/messaging-gateway Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-6328...

Symantec Messaging Gateway performRestore Command Injection (CVE-2017-6327)

A command injection vulnerability exists in Symantec Messaging Gateway. The cause of the vulnerability due to combination of an authentication bypass in LoginAction and a lack of sanitization on user input...

Symantec Messaging Gateway RestoreAction.performRestore() RCE

Remote command execution vulnerability in Symantec Messaging Gateway RestoreAction.performRestore localBackupFileSelection parameter Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

PT-2017-2879

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 8.0 Description The issue is related to insufficient access control in the Android operating system's messaging component. It may allow a remote attacker to cause a denial of service. Recommendations For Android...