The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the ssleayrandbytes function in the OpenSSL library is related to buffer overflows in dynamic memory, caused by integer overflows. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by establishing multiple TLS sessions remotely...

Design/Logic Flaw

bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic...

HTTPie - a CLI, cURL-like tool for humans

HTTPie pronounced aych-tee-tee-pie is a command line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. It provides a simple http command that allows for sending arbitrary HTTP requests using a simple and natural syntax, and displays colorized output...

CVE-2015-3963

Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnetcoreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number ISN values, which...

CVE-2015-3960

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by...

Hardcoded credentials

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by...

CVE-2015-3960

The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by...

PivotX Multiple Vulnerabilities (Jul 2015)

PivotX is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:pivotx:pivotx"; if description...

Code injection

Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number ISN values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value...

Multiple Cross-Site Scripting Vulnerabilities in Cisco Identity Services Engine (CNVD-2015-04709)

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine, which could be exploited by remote attackers to inject malicious script or HTML code that, when viewed with malicious data,...

TYPO3 CMS Session Fixation Vulnerability

TYPO3 is a free and open source content management system. A security vulnerability exists in TYPO3 CMS that allows remote attackers to exploit the vulnerability to submit special requests, hijack sessions, and gain unauthorized access to the application...

The vulnerability of the Ubuntu operating system, which allows a hacker to trigger a service failure

The vulnerability of the Ubuntu operating system is related to a memory reclamation error. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by closing the SSL session at a certain time...

Session fixation

Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess parameter...

CVE-2015-5458

PivotX (fileupload.php) is affected by CVE-2015-5458: a session fixation vulnerability in PivotX before 2.3.11 allows remote attackers to hijack sessions via the sess parameter. Affected software: PivotX prior to 2.3.11; remediation is to upgrade to PivotX 2.3.11 or later (per CVE references).

CVE-2015-3216

CVE-2015-3216: Race condition in the PRNG lock (ssleay_rand_bytes) in OpenSSL (openssl-1.0.1e-25.el7 in Red Hat RHEL 7 and similar) can cause remote DoS by exhausting threads through many TLS sessions, potentially triggering a segfault. Connected docs corroborate OpenSSL involvement and related a...

IBM WebSphere MQ Information Disclosure Vulnerability

IBM WebSphere MQ is a messaging middleware product from IBM, USA. The product focuses on providing reliable and proven messaging for Service Oriented Architecture SOA. An information disclosure vulnerability exists in versions of IBM WebSphere MQ prior to 8.0.0.3. Allows remote attackers to obtai...

WordPress Salient theme cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, the platform supports personal blog sites on servers with PHP and MySQL.Salient is a work display theme. The WordPress Salient theme suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the...

IBM Security QRadar Incident Forensics Cross-Site Scripting Vulnerability

IBM Security QRadar Incident Forensics is a suite of security forensic investigation software. A cross-site scripting vulnerability in IBM Security QRadar Incident Forensics allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain...

OpenStack Horizon Cross-Site Scripting Vulnerability

OpenStack is a cloud platform management project.Horizon is a dashboard project that provides users and administrators with a Web-based user interface for managing OpenStack services. A cross-site scripting vulnerability exists in OpenStack Horizon, which allows remote attackers to exploit the...

SAP HANA Encryption Vulnerabilities

SAP’s in-memory relational database management system, HANA, contains a whopper of a security weakness: a default encryption key guarding passwords, stored data and backups. Researchers from ERPScan, which recently uncovered serious configuration vulnerabilities in Oracle PeopleSoft products, on...