Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

Session fixation

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

CVE-2015-2284

CVE-2015-2284 affects SolarWinds Firewall Security Manager (FSM) prior to version 6.6.5 HotFix1, with a vulnerability in userlogin.jsp that enables an unauthenticated remote attacker to gain privileges and execute arbitrary code via a client session handling flaw. The linked sources indicate mult...

Cisco Prime Security Manager Network Time Protocol Daemon (ntpd) Multiple Vulnerabilities (cisco-sa-20141222-ntpd)

According to its self-reported version number, the version of Cisco Prime Security Manager running on the remote host is prior to 9.3.3.2. It is, therefore, affected by multiple vulnerabilities in the bundled NTP libraries : - A security weakness exists due to the configauth function improperly...

SolarWinds Firewall Security Manager Arbitrary Code Execution Vulnerability

SolarWinds Firewall Security Manager FSM is a suite of multi-vendor firewall security and change management software from SolarWinds USA. A security vulnerability exists in the installation process of SolarWinds FSM. A remote attacker could exploit the vulnerability to execute arbitrary code...

HP ArcSight Enterprise Security Manager and Logger security vulnerabilities

No description provided...

CVE-2014-7885

HP ArcSight Enterprise Security Manager (ESM) prior to 6.8c is affected by multiple remote vulnerabilities (CVE-2014-7885). The Nessus entry cites XSS due to failure to validate tooltip input and CSRF allowing changes to rules or resources via a crafted link; affected versions include ESM before ...

SolarWinds Firewall Security Manager userlogin.jsp Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Firewall Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of client sessions. The issue lies in the ability to...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username'...

IBM SDK Java Technology Information Disclosure Vulnerability

IBM SDK Java Technology is a Java Standard Development Kit SDK from IBM. An information disclosure vulnerability exists in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10,7R1 before SR2-FP10 that could allow a remote attacker to obtai...

Security feature bypass

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

CVE-2014-8891

Unspecified vulnerability in the Java Virtual Machine JVM in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vector...

CVE-2014-8892

CVE-2014-8892 affects IBM SDK/JVM used by Tivoli Storage Productivity Center (IBM Java Technology Edition). The IBM security bulletin describes the vulnerability as a bypass of permission checks under a security manager, potentially allowing untrusted code to view sensitive information. Remediati...

CVE-2014-8891

CVE-2014-8891 affects IBM SDK, Java Technology Edition (IBM JRE) under multiple releases: 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10. The vulnerability allows remote attackers to escape the Java sandbox and execute arbitrary code through...

F5 Networks BIG-IP : ASM < 11.6.0 Response Body XSS

The F5 Networks Application Security Manager ASM running on the remote device is prior to version 11.6.0. It is, therefore, affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to the 'Response Body' field when a new user account is being created. A...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Security Manager

Cisco Security Manager centralizes the task of configuring policies and controls for Cisco security deployments, enabling efficient management of enterprise-level security. Cisco Security Manager has multiple cross-site scripting vulnerabilities due to the program failing to properly filter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and...