CVE-2015-6853

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

Cross site request forgery (csrf)

The non-Domino web agents in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted request...

Cross site request forgery (csrf)

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

CVE-2015-6854

The non-Domino web agents in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted request...

CVE-2015-6854

CA Single Sign-On (SSO) non-Domino Web Agent affected across multiple releases: R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5. The issue allows remote attackers to trigger a denial of service (daemon crash) or access sensitive information via a crafted request. Root cau...

CVE-2015-6853

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

CVE-2015-6853

Technical details about CVE-2015-6853 are not publicly provided in the supplied documents; sources largely reiterate the vulnerability exists and can cause DoS or information disclosure. Monitor for updates.

Moodle Single View Design Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Single View in versions 2.8.x prior to Moodle 2.8.1...

CVE-2016-1360

Cisco Prime LAN Management Solution LMS through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging console connectivity, aka Bug ID CSCuw85390...

How to Change Management IP and Default Gateway Using NetScaler CLI

This article describes how to change management IP address and add new default gateway address using NetScaler CLI. Changing the Default Gateway of the NetScaler appliance can only be done via the CLI. The NetScaler appliance can only have 1 Default Gateway defined at a time...

Recursively Crawl Single Page Applications: htcap

htcap is a web application scanner able to crawl single page application SPA in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it’s focused mainly on the crawling process and uses external tools to discover vulnerabilities. It’...

apache-cxf: SAML SSO processing is vulnerable to wrapping attack

It was found that Apache CXF permitted wrapping attacks in its support for SAML SSO. A malicious user could construct a SAML response that would bypass the login screen and possibly gain access to restricted information or resources...

Paragon Initiative Enterprises: Full Path Disclosure In EasyDB

Hi, as reported in 115337 about a full path disclosure in EasyDB you fixed some of them in last commits but single function is vulnerable too and not fixed yet! ifcount$params != count$params,COUNTRECURSIVE throw new \InvalidArgumentException"Invalid params"; this will check $params to be 1d arra...

DOKEOS ce30 Authentication Bypass

Advisory ID: HTB23289 Product: DOKEOS Vendor: DOKEOS Vulnerable Versions: ce30 and probably prior Tested Version: ce30 Advisory Publication: January 7, 2016 without technical details Vendor Notification: January 7, 2016 Public Disclosure: February 17, 2016 Vulnerability Type: Improper...

DOKEOS SSO Authentication Bypass Vulnerability

Dokeos is an open source online education and course management system. A security vulnerability exists in DOKEOS. The vulnerability is caused by a variable type obfuscation error when comparing passwords to unserializable strings during authentication, SSO authentication is not possible...

CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...

Keybase: Remote Server Restart Lead to Denial of Server by only one Request.

URL === https://keybase.io//api/1.0/merkle/block.json?hash=68b5d3599be9acbe97bcc45603a322f85f8a99b9cbc696592fe1088c3a099a45d929f0bc2fae2230f0b31b5e4b4122365f50b34fcf91a94a357df90a83e3b013 Poc: ==== https://keybase.io//api/1.0/merkle/block.json?hash=1 see video...

CVE-2016-1941

The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

CVE-2016-1937

The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...

CVE-2016-1941

The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended...