CVE-2015-6853: Insufficient Verification of Data Authenticity

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

CVE-2016-0755: Improper Authentication

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015...

CVE-2014-4876: Exposure of Sensitive Information to an Unauthorized Actor

Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment variables via a crafted request to TCP port 54138...

Firebird: Buffer Overflow

Background Firebird is a multi-platform, open source relational database. Description The vulnerability is caused due to an error when processing requests from remote clients. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of...

IBM Security QRadar Incident Forensics Cross-Site Request Forgery Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software from IBM. The software supports in-depth forensic investigations of suspected malicious network security incidents, and repair network security vulnerabilities. A cross-site request forgery vulnerability...

CVE-2015-4997: Undefined Security Weakness

IBM WebSphere Portal 8.5.0 before CF08 allows remote attackers to bypass intended access restrictions via a crafted request...

CVE-2015-6484: Undefined Security Weakness

3S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted 1 GET or 2 POST request...

PT-2015-3300

Name of the Vulnerable Software and Affected Versions NTP versions 4.x before 4.2.8p4 NTP versions 4.3.x before 4.3.77 Description The rate limiting feature in NTP allows remote attackers to have unspecified impact via a large number of crafted requests. This issue exists due to insufficient inpu...

CVE-2015-1943: Undefined Security Weakness

IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...

CVE-2015-4020: Improper Input Validation

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original...

Google Image CSRF Vulnerability & Using it as a Botnet

Exploit for php platform in category web applications / Exploit Title: Google Image CSRF Vulnerability & Using it as a Botnet Exploit Author: C4T Vendor Homepage : http://images.google.com Google Dork: none Tested on: Linux & Windows ====================================================== Google...

CVE-2015-5696: Improper Input Validation

Dell Netvault Backup before 10.0.5 allows remote attackers to cause a denial of service crash via a crafted request...

CVE-2015-5618: Undefined Security Weakness

Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and 1 read or 2 modify a Voice Time Set configuration settings via a request to voice.htm or b UniFinger configuration settings via a request to bf.htm, a different vulnerability than...

CVE-2015-1833: Improper Input Validation

XML external entity XXE vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request...

CVE-2015-4091: Undefined Security Weakness

XML external entity XXE vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tcsldwdmain/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851...

CVE-2014-8384: Undefined Security Weakness

The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted request...

CVE-2015-0113: Exposure of Sensitive Information to an Unauthorized Actor

The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...

CVE-2013-7439: Undefined Security Weakness

Multiple off-by-one errors in the 1 MakeBigReq and 2 SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow...

CVE-2014-5427: Exposure of Sensitive Information to an Unauthorized Actor

Johnson Controls Metasys 4.1 through 6.5, as used in Application and Data Server ADS, Extended Application and Data Server aka ADX, LonWorks Control Server 85 LCS8520, Network Automation Engine NAE 55xx-x, Network Integration Engine NIE 5xxx-x, and NxE8500, allows remote attackers to read passwor...

CVE-2015-2682: Undefined Security Weakness

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml...