Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250

Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Concrete5 Affected Software : Concrete5 Affected Versions: 5.7.3.1 and possibly below Vendor Homepage : https://www.concrete5.org Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID:...

PT-2015-5470 · Pcs +2 · Pcs +2

Name of the Vulnerable Software and Affected Versions: PCS versions 0.9.137 and earlier Description: The issue concerns the pcs daemon pcsd in PCS, where it fails to set the secure flag for a cookie in an https session. This oversight makes it easier for remote attackers to capture the cookie by...

Huawei SEQ Analyst suffers from multiple cross-site scripting vulnerabilities

Huawei SEQ Analyst is a solution with proven big data storage and analysis capabilities. Huawei SEQ Analyst fails to properly filter multiple parameters, which can be exploited by a remote attacker to construct malicious URIs and trick users into parsing them, which can obtain sensitive cookies,...

Authentication flaw

The communication module on the Hospira LifeCare PCA Infusion System before 7.0 does not require authentication for root TELNET sessions, which allows remote attackers to modify the pump configuration via unspecified commands...

IBM WebSphere MQ XR WebSockets Listener Cross-Site Scripting Vulnerability

IBM WebSphere MQ is a messaging middleware product that provides a reliable and proven messaging backbone for Service Oriented Architecture SOA. A cross-site scripting vulnerability in IBM WebSphere MQ XR WebSockets Listener allows remote attackers to exploit the vulnerability to inject malicious...

Windows Interactive Powershell Session, Reverse TCP

Listen for a connection and spawn an interactive powershell session This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include...

Multiple Lenovo ThinkServer Products ThinkServer System Manager Baseboard Management Controller Encryption Issue Vulnerability

Lenovo ThinkServer System Manager TSM Baseboard Management Controller BMC for ThinkServer RD350, etc. is a controller from Lenovo, China, embedded in the hardware devices of ThinkServer RD350, etc. for managing and monitoring server status. Lenovo's Baseboard Management Controller BMC for...

No title provided

A denial of service flaw was found in the OpenStack Dashboard horizon when using the db or memcached session engine. An attacker could make repeated requests to the login page, which would result in a large number of unwanted backend session entries, possibly leading to a denial of service...

No title provided

A denial of service flaw was found in the OpenStack Dashboard horizon when using the db or memcached session engine. An attacker could make repeated requests to the login page, which would result in a large number of unwanted backend session entries, possibly leading to a denial of service...

Multiple Reflected Cross-Site Scripting Vulnerabilities in Kemp Virtual LoadMaster

Kemp Virtual LoadMaster is a virtual load balancer. Kemp Virtual LoadMaster suffers from multiple cross-site scripting vulnerabilities that can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies, hijack...

DLA-198-1 wireshark - security update

Bulletin has no description...

Multiple Websense Product Cross-Site Scripting Vulnerabilities

Websense TRITON is the Unified Content Architecture for data security. A cross-site scripting vulnerability in Investigative Reports in multiple Websense TRITON products allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access ...

Multiple Cross-Site Scripting Vulnerabilities in ocPortal

ocPortal is a content management system. Multiple cross-site scripting vulnerabilities exist in ocPortal. The vulnerabilities can be exploited to allow remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when maliciou...

Cisco Intrusion Prevention System (IPS) Software Competitive Conditions Vulnerability

Cisco Intrusion Prevention System IPS is the United States Cisco Cisco a set of intrusion prevention system. The system can instantly interrupt, adjust or isolate some abnormal or harmful network data transmission behavior. A competitive condition vulnerability exists in the TLS implementation of...

SolarWinds Firewall Security Manager userlogin.jsp Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Firewall Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of client sessions. The issue lies in the ability to...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2015-01631)

Microsoft SharePoint Server is an integrated suite of server capabilities that provides comprehensive content management and enterprise search, accelerates shared business processes, and facilitates information sharing across boundaries. Microsoft SharePoint Server fails to properly process...

MS15-030: Description of the security update for Remote Desktop protocol: March 10, 2015

None None...

CVE-2015-1464

RT aka Request Tracker before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL...

SuSE 11.3 Security Update : wireshark (SAT Patch Number 10279)

wireshark has been updated to version 1.10.12 to fix six security issues : - The WCCP dissector could crash. bnc912365. CVE-2015-0559 / CVE-2015-0560 - The LPP dissector could crash. bnc912368. CVE-2015-0561 - The DEC DNA Routing Protocol dissector could crash. bnc912369. CVE-2015-0562 - The SMTP...

WordPress AdPlugg Plugin <= 1.1.33 - Stored Cross Site Scripting

Because of this vulnerability, attackers can hijack other users session, take control of another administrator's browser or install malware on their computer. Solution Upgrade the plugin...