Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1820 Release Date: ============= 2016-04-19 Vulnerability Laboratory ID VL-ID: ==================================...

Cyberoam CC v02.03.1 - Multiple Persistent Vulnerabilities

Document Title: =============== Cyberoam CC v02.03.1 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1721 Cyberoam Ticket ID: 1001314 Case ID: CCC-4208 Release Date: ============= 2016-04-18 Vulnerability Laboratory ...

Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1820 Release Date: ============= 2016-04-18 Vulnerability Laboratory ID VL-ID: ==================================...

Man-in-the-middle Hijacking Vulnerability in Multiple Vmware Products

vCenter Server is a suite of server and virtualization management software. vCloud Director vCD is a suite of virtual cloud infrastructure tools. Multiple Vmware products fail to handle sessions in a secure manner, allowing remote attackers to exploit the vulnerability for man-in-the-middle and...

BlackBerry Enterprise Service Cross-Site Scripting Vulnerability (CNVD-2016-02337)

BlackBerry Enterprise Server is a wireless solution. The solution provides a unified architecture for mobile devices to access enterprise applications, wireless email communications. A cross-site scripting vulnerability exists in BlackBerry Enterprise Server, which allows remote attackers to...

CVE-2016-2076

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

Code injection

Client Integration Plugin CIP in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site...

CVE-2016-2076

CVE-2016-2076 affects VMware products including vCenter Server (5.5 U3a/U3b/U3c and 6.0 before U2), vCloud Director 5.5.5, and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1. The issue is improper handling of session content by the VMware Client Integration Plugin (CIP), enabling rem...

VMware Security Updates for vCenter Server (VMSA-2016-0004)

VMware vCenter Server updates address a critical security issue. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM Financial Transaction Manager for Corporate Payment Services Cross-Site Scripting Vulnerability

IBM Financial Transaction Managerfor Corporate Payment Services is a financial transaction manager product that focuses on monitoring, tracking, and reporting financial payments and transactions. A cross-site scripting vulnerability in IBM FTM for Corporate Payment Services on multiple platforms...

Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability

Document Title: =============== Django CMS v3.2.3 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1821 Release Date: ============= 2016-04-13 Vulnerability Laboratory ID VL-ID: ==================================...

C & C++ for OS - Filter Bypass & Persistent Vulnerability

Document Title: =============== C & C++ for OS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1825 Release Date: ============= 2016-04-13 Vulnerability Laboratory ID VL-ID: ====================================...

WPN-XM 0.8.6 Cross Site Scripting

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WPNXM-XSS.txt Vendor: =========== wpn-xm.org Product: ======== WPN-XM Serverstack for Windows - Version 0.8.6 WPN-XM is a free and open-source web server solution stack for professional PHP...

Amazon Linux AMI : tomcat8 (ALAS-2016-679)

ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt other web...

Cross-site request forgery (CSRF) vulnerability in administrate gem

"Administrate::ApplicationController actions didn't have CSRF protection. Remote attackers can hijack user's sessions and use any functionality that administrate exposes on their behalf."...

Amazon Linux: Security Advisory (ALAS-2016-679)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DirectAdmin CP v1.50.0 - CS CSRF Web Vulnerability

Document Title: =============== DirectAdmin CP v1.50.0 - CS CSRF Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1783 Release Date: ============= 2016-03-20 Vulnerability Laboratory ID VL-ID: ==================================== 1783...

Gratipay: auto-logout after 20 minutes

Hi, Session is not getting expired even after keeping the application idle for 20 min and after browser closure. Information: JavaScript code can be used by the web application in all or critical pages to automatically logout client sessions after the idle timeout expires, for example, by...

Medium: tomcat7

Issue Overview: A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application in a getResource,...

Updated tomcat packages fix security vulnerabilities

Updated tomcat packages fix security vulnerabilities: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x before 7.0.65 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used b...