ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DowntimeSchedulerServlet servlet. The issue lies in the failure ...

F5 Networks BIG-IP : PHP vulnerability (SOL15169)

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted document that is processed by the xmlparseintostruct function. C Tenable Network...

Adobe Acrobat Multiple Vulnerabilities - 01 (May 2015) - Mac OS X

Adobe Acrobat is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:acrobat"; ifdescription...

ManageEngine OpManager APMAlertOperationsServlet source SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the APMAlertOperationsServlet servlet. The issue lies in the failure to sanitiz...

Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)

The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities : - A buffer overflow condition exists in CoolType.dll due to improper validation of user-supplied input. A remote attacker can exploit th...

Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability

A vulnerability within the administrative interface of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input submitted to an affected device. An unauthenticate...

Google Chrome < 42.0.2311.152 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 42.0.2311.152. It is, therefore, affected by multiple vulnerabilities related to Adobe Flash : - An unspecified security bypass flaw exists that allows an attacker to disclose sensitive information. CVE-2015-3044 -...

Novell ZENworks Configuration Management < 11.3.2 Remote Code Execution (intrusive check)

The version of Novell ZENworks Configuration Management ZCM running on the remote host is affected by a remote code execution vulnerability due to improper sanitization of user-supplied input to the 'uid' POST parameter in the /zenworks/UploadServlet script. An unauthenticated, remote attacker ca...

ManageEngine OpManager UpdateProbeUpgradeStatus probeName SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UpdateProbeUpgradeStatus servlet. The issue lies in the failure to sanitize...

ManageEngine Applications Manager DBUtil port SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DBUtil class. The issue lies in the failure to sanitize...

Foxit PhantomPDF < 7.1.5 Multiple DoS Vulnerabilities

Foxit PhantomPDF is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

F5 Networks BIG-IP : NTP vulnerability (K16505)

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. CVE-2015-1798 C Tenable Network Security...

WordPress < 3.7.6 / 3.8.6 / 3.9.4 / 4.1.2 Multiple Vulnerabilities

According to its version number, the WordPress application running on the remote web server is potentially affected by multiple vulnerabilities : - An unspecified flaw exists that allows an attacker to upload arbitrary files with invalid or unsafe names. Note that this only affects versions 4.1 a...

Novell Zenworks GetStoredResult.class SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetReRequestData method of the GetStoredResult class. The issue lies in the failur...

Axway SecureTransport Directory Traversal Vulnerability

Axway SecureTransport is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Moodle 2.5.x < 2.5.7 / 2.6.x < 2.6.4 / 2.7.x < 2.7.1 XSS

Binary data 8722.prm...

Juniper Junos SRX Series Dynamic VPN XSS (JSA10677)

According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a cross-site scripting vulnerability due to a flaw in Dynamic VPN. A remote attacker can exploit this to view sensitive information or session credentials. Note that this issue only affects...

ManageEngine OpManager APMIntegBusinessViewHandler Delete SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the APMIntegBusinessViewHandler servlet. The issue lies in the failure to...

Ember.js XSS Vulnerability With {{view "select"}} Options

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the select view means that any user-supplied data bound to an option's label will not be escaped correctly. In applicatio...

Adobe ColdFusion Unspecified XSS (APSB15-07) (credentialed check)

The version of Adobe ColdFusion running on the remote Windows host is affected by an unspecified reflected cross-site scripting XSS vulnerability due to a failure to properly sanitize user-supplied input. A remote attacker, using a crafted request, can exploit this to execute arbitrary script cod...