Aethra SV2242E XXE Injection

Author : Ahmed Sultan Email : [email protected] Vuln. software : Aethra SV2242E Vendor site : aethra.it CVE : Requested , but haven't been assigned yet tested on : ATOS 5.6.x The bug rise because of the remote user input to "/cgi-bin/AmiWeb" is not sensitized before being parsed which cause the...

EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server

It was found that JBoss EAP did not properly authorize a user performing a shut down. A remote user with the Monitor, Deployer, or Auditor role could use this flaw to shut down the EAP server, which is an action restricted to admin users...

EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server

It was found that JBoss EAP did not properly authorize a user performing a shut down. A remote user with the Monitor, Deployer, or Auditor role could use this flaw to shut down the EAP server, which is an action restricted to admin users...

qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support

Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the AMD PC-Net II Ethernet Controller support is vulnerable to a heap buffer overflow flaw. While receiving packets in the loopback mode, it appends CRC code to the receive buffer. If the data size given is same as...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2015-07821)

CloudBees Jenkins is the open source continuous integration server. A cross-site scripting vulnerability exists in CloudBees Jenkins 1.638, LTS versions prior to 1.625.2, in the slave overview page, where a remote user with certain privileges can inject web script or HTML via a slave offline stat...

Ipsilon Denial of Service Vulnerability

Ipsilon is a server and toolkit for configuring Apache-based service providers. A denial of service vulnerability exists in Ipsilon version 0.1.0 prior to 1.0.1. It allows an authenticated remote user to cause a denial of service via a duplicate SP name...

TIBCO LogLogic Unity Information Disclosure Vulnerability

TIBCO LogLogic Unity is an acquisition by U.S.-based infrastructure software provider TIBCO to deliver the industry's leading scalable logging and security management platform specifically designed for the enterprise and cloud. An information disclosure vulnerability exists in versions of TIBCO...

Multiple Cross-Site Scripting Vulnerabilities in Cisco FireSIGHT Management Center

Cisco FireSIGHT Management Center is the United States Cisco Cisco company's set of support for centralized management of the use of FirePOWER Services Cisco ASA and Cisco FirePOWER network security equipment network security and operational functions of the management center software. Multiple...

Cisco IOS Software Tunnel Interfaces Security Bypass Vulnerability

A vulnerability in Cisco devices running IOS Software versions 15.204M6 and 15.403S configured with access control lists ACLs could allow an unauthenticated, remote user connected to a tunnel interface to bypass configured ACLs on tunnel interfaces if the ACL on the physical interface permits the...

CVE-2015-8105

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

CVE-2015-8003

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads...

Cisco Secure Access Control Server Security Restriction Bypass Vulnerability (CNVD-2015-07358)

Cisco Secure Access Control Server that is ACS, is the United States Cisco Cisco a security access control server. A security restriction bypass vulnerability exists in Cisco Secure Access Control Server 5.7. It allows an authenticated remote user to bypass expected RBAC restrictions and create...

System Security Services Daemon Denial of Service Vulnerability

System Security Services Daemon SSSD is a system security services daemon, which is a process between the local user and the datastore that supports access to a variety of authentication servers, such as LDAP, Kerberos, etc., and provides authorization. System Security Services Daemon version 1.1...

Cisco Adaptive Security Appliance CX Context-Aware Security Information Disclosure Vulnerability

The Cisco Adaptive Security Appliance ASA CX Context-Aware Security Software is an add-on service module for extending the ASA platform from Cisco USA. An information disclosure vulnerability exists in Cisco Adaptive Security Appliance CX Context-Aware Security 9.3. It allows an authenticated...

Cisco Secure Access Control Server SQL Injection Vulnerability

Cisco Secure Access Control Server that is ACS, is the United States Cisco Cisco a security access control server. A SQL injection vulnerability exists in Cisco Secure Access Control Server 5.7. It allows an authenticated remote user to execute arbitrary SQL commands via a crafted URL...

openSUSE: Security Advisory for java-1_8_0-openjdk (openSUSE-SU-2015:1905-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for java-1_8_0-openjdk (important)

java-180-openjdk was updated to fix 24 security issues. These security issues were fixed: - CVE-2015-4734: A remote user can exploit a flaw in the Embedded JGSS component to partially access data - CVE-2015-4803: A remote user can exploit a flaw in the JRockit JAXP component to cause partial deni...

Infinite Automation Mango Automation Arbitrary Command Execution Vulnerability

Infinite Automation Mango Automation is the United States Infinite Automation Systems, Inc. of a set of open source Web-based SCADA data acquisition and supervisory control, HMI and automation software. Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430, has an arbitrary...

TIBCO Spotfire Server Information Disclosure Vulnerability (CNVD-2015-07300)

TIBCO Spotfire Analyst Platform for AWS Marketplace is a suite of data visualization and analytics platforms for AWS, the cloud application store, from TIBCO Software, USA. Versions 5.5.x prior to 5.5.4, 6.0.x prior to 6.0.5, 6.5.x prior to 6.5.4, 7.0.x prior to 7.0.1 of TIBCO Spotfire Server,...

Design/Logic Flaw

OpenStack Image Service Glance before 2014.2.4 juno and 2015.1.x before 2015.1.2 kilo allows remote authenticated users to bypass the storage quota and cause a denial of service disk consumption by deleting images that are being uploaded using a token that expires during the process. NOTE: this...