CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-2878

Multiple cross-site request forgery CSRF vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2016-3009

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page...

Security Advisory - XSS Vulnerability in Huawei eSpace IAD

Huawei eSpace Integrated Access Device IAD has a reflected cross-site scripting XSS vulnerability. An attacker could trick a user into clicking a URL containing malicious scripts. Then the user's browser may receive a response from the eSpace IAD and execute the malicious scripts. Successful...

Cross-site Scripting Vulnerability in ZhengTong Content Management System

The GovContent Management System is a website management system designed and built on the JAVA EE platform, which is mainly used for the website construction and management of government agencies, enterprises and institutions. A cross-site scripting vulnerability exists in the CMS. The...

Cisco IP Interoperability and Collaboration System Cross-Site Scripting Vulnerability

The Cisco IP Interoperability and Collaboration System is a set of solutions that provide voice interoperability across different systems based on IP standards. A cross-site scripting vulnerability exists in Cisco IP Interoperability and Collaboration System Universal Media Services, which can be...

CVE-2016-9028 - Unauthorized Redirect flaw in Citrix NetScaler ADC could result in session hijack

Description of Problem An unauthorized redirect vulnerability has been identified in Citrix NetScaler ADC in the AAA-TM flow that could allow a remote attacker to obtain session cookies of a redirected AAA user. This vulnerability does not impact NetScaler Gateway. The following vulnerability has...

XSS Vulnerability in NetEase Mail Master Client Android Version

NetEase Mail Master client is a universal email client launched by NetEase 163. An XSS vulnerability exists in the Android version Ver4.14.1 of the NetEase Mail Master client. It allows attackers to insert malicious js code into the page to obtain user cookies and other information, leading to us...

Cisco Host Scan HostScan Engine Cross-Site Scripting Vulnerability

Cisco Adaptive Security Appliances Web VPN is a set of modules for configuring Web VPN on ASA firewalls. A cross-site scripting vulnerability in the HostScan Engine in the Cisco Host Scan package used by Cisco Adaptive Security Appliances Web VPN allows remote attackers to exploit the vulnerabili...

Cross-site Scripting Vulnerability in EaseUS Content Management System

EECO Content Management System is a marketing enterprise website system developed based on SEO-friendliness. There is an XSS cross-site scripting vulnerability in EE Content Management System. The vulnerability file is comment.php, due to the safecheck function is not filtered completely, the...

Microsoft Windows Elevation of Privilege Vulnerability (CNVD-2016-07924)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the United States. kernel is the kernel. A session object elevation of privilege vulnerability exists in the kernel in Microsoft Windows, which arises from a program's failure to properly handle objects in the...

CVE-2016-3306

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges...

CVE-2016-3306

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and consequently gain privileges...

Moxa MiiNePort Session Hijack Vulnerabilities

OVERVIEW Independent researcher Aditya Sood has identified vulnerabilities in Moxa’s MiiNePort. Moxa has produced new firmware editions to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS Moxa reports that the vulnerabilities affect the followin...

kibana: Session hijack via stealing cookies and auth headers from log ESA-2016-04

A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as...

CVE-2016-2998

Cross-site request forgery CSRF vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data...

Multiple XSS Cross-Site Scripting Vulnerabilities in UFIDA ISM System

UFIDA ISM system is a new generation of enterprise IT service management products. Multiple XSS cross-site scripting vulnerabilities exist in UFIDA ISM System. It allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking. Th...

Cisco IP Phone 8800 Series Cross-Site Scripting Vulnerability

The Cisco IP Phone 8800 Series is a telephony product that provides video and VoIP communication features. A cross-site scripting vulnerability exists in the Cisco IP Phone 8800 Series, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can b...

IBM Lotus Protector for Mail Security Cross-Site Scripting Vulnerability

IBM Lotus Protector for Mail Security is a suite of email content filtering solutions for IBM Lotus Notes, IBM Lotus Domino, Microsoft Exchange and hybrid email environments. A cross-site scripting vulnerability exists in IBM Lotus Protector for Mail Security, which allows remote attackers to...

DEBIAN-CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...