876 matches found
Enhancesoft osTicket Cross-Site Scripting Vulnerability
Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. A security vulnerability exists in Enhancesoft osTicket version 1.10.1. An attacker can exploit the vulnerability to execute arbitrary client-side...
WordPress Ultimate Affiliate Pro Plugin Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Ultimate Affiliate Pro plugin. An attacker can exploit this...
BSA-2017-500
Security Advisory ID : BSA-2017-500 Component : Apache HTTPD Revision : 1.0: Final It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decryp...
Oracle PeopleSoft ToolsRelease 8.55.03 / ToolsReleaseDB 8.55 / HCM 9.2 XSS Vulnerabilities
PeopleSoft ToolsRelease version 8.55.03, ToolsReleaseDB version 8.55, and HCM version 9.2 suffer from a TestServlet cross site scripting vulnerability. 1. ADVISORY INFORMATION Title: Multiple XSS POST request Vulnerabilities in TestServlet PeopleSoft Advisory ID: ERPSCAN-17-037 Advisory URL:...
Siemens OZW672 and OZW772 Data Read/Write Vulnerability
Siemens OZW672 and OZW772 are both building controller products from Siemens, Germany. A data read/write vulnerability exists in the Siemens OZW672 and OZW772. An attacker can exploit the vulnerability to read and write historical measurement data under certain conditions, or read and modify data...
WordPress WP Statistics Plugin Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress WP Statistics plugin. An attacker can exploit this vulnerability...
IBM Sterling B2B Integrator Information Disclosure Vulnerability (CNVD-2017-13823)
IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. An information disclosure vulnerability exists in IBM Sterlin...
CVE-2017-1349
IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID: 126525...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...
Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7
An update is now available for Red Hat JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...
Security Bypass Vulnerability in Security Component of Multiple Apple Products
Apple macOS Sierra, iOS, and tvOS are products of Apple Inc. macOS Sierra is a specialized operating system for Mac computers; iOS is an operating system for mobile devices. security is one of the information security and privacy components. A security vulnerability exists in the Security compone...
Open Redirect
Apache jUDDI is vulnerable to open redirect attacks. There is a flaw which leads the logout jsp page to redirect to the login page after logging out of the portal. Therefore, a malicious user can use the flaw to redirect to an unintended web page. This would be done after the clearing of user...
McAfee Network Data Loss Prevention Cross-Site Scripting Vulnerability (CNVD-2017-07553)
McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP suffers from a cross-site scripting vulnerability in the server implementation, which can be exploited by remote attackers to view session and cookie information by modifying HTTP...
Wordpress EELV Newsletter Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in the s value of the Wordpress EELV Newsletter page allows remote attackers to exploit...
openSUSE Security Update : libressl (openSUSE-2017-560)
This update for libressl to version 2.5.1 fixes the following issues : These security issues were fixed : - CVE-2016-0702: Prevent side channel attack on modular exponentiation boo968050. - CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing...
openSUSE Security Update : libressl (openSUSE-2017-561)
This update for libressl to version 2.5.1 fixes the following issues : These security issues were fixed : - CVE-2016-0702: Prevent side channel attack on modular exponentiation boo968050. - CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...