1073 matches found
Webmin vulnerable to cross-site scripting
Overview Webmin is a web-based system management tool. Webmin contains a cross-site scripting vulnerability when "referrer checking" is turned off. Note that "referrer checking" is enabled by default. hasegawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...
JVN#61247051: OpenSSL improper handling of Change Cipher Spec message
OpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM man-in-the-middle attacker to force a server and a client to use easily guessable cryptgraphic key material during the initial SSL/TLS handshake CWE-325. Impact SSL/TLS communication between the...
Oracle / Sun / MySQL / PeopleSoft / OpenJDK applications multiple security vulnerabilities
104 vulnerabilities in quarterly Critical Patch Update...
AndExplorer vulnerable to directory traversal
Overview AndExplorer provided by LYSESOFT contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...
PT-2014-17: Weak encryption of account data in Wonderware Information Server
The specialists of the Positive Research center have detected a Weak encryption of account data vulnerability in Wonderware Information Server. Encryption of WIS is insufficient. This vulnerability could allow elevation of privileges if an attacker decrypts the credentials. The system would need ...
PT-2014-35: Stack-based buffer overflow in Honeywell EPKS
The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in function hscsconf which could lead possible remote code execution or denial of service. How to fix Update your sofware up to t...
PT-2014-44: Heap-based buffer overflow in Honeywell EPKS
The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svcdataio from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...
JVN#24730765: Blackboard Vista/CE vulnerable to cross-site scripting
Blackboard Vista/CE is a learning management system LMS. Blackboard Vista/CE contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the information provided by the...
PT-2013-76: Local File Inclusion in LiveStreet CMS
The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in LiveStreet CMS. Insufficient validation of user input in the install\index.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...
PT-2014-76: Cross-Site Scripting in Kasseler CMS
The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the engine.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fi...
PT-2016-35: XML External Entity Injection in Liebert SiteScan
The specialists of the Positive Research center have detected an XML External Entity Injection vulnerability in Liebert SiteScan. Vulnerability in Liebert SiteScan allows attackers to obtain sensitive information via a specially crafted XML request. How to fix Update your software up to the lates...
MGASA-2013-0288 Updated glpi package fixes security vulnerabilities
Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 CVE-2013-2226, 0.83.91 CVE-2013-2225, and 0.84.2 CVE-2013-5696. This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues...
PT-2013-65: Sensitive Information Disclosure in Jetty
The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in Jetty on Windows. The system does not consider that NTFS allows users to address files with extended syntax, while matching the requested resource URL with locations defined in web...
Yafuoku! contains an issue where it fails to verify SSL server certificates
Overview Yafuoku! provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Zachary Mathis of Proactive Defense Kobe Digital Labo reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
PT-2013-49: Null Byte Injection in Oracle Containers for J2EE
The specialists of the Positive Research center have detected a Null Byte Injection vulnerability in Oracle Containers for J2EE. Oracle Containers for J2EE does not properly handle a null byte in the path when transferring a request to another static page or a JSP script via pageContext.forward o...
PT-2013-47: Directory Traversal in Oracle Containers for J2EE
The specialists of the Positive Research center have detected a Directory Traversal vulnerability in Oracle Containers for J2EE when running on Windows. Oracle Containers for J2EE does not properly handle a Request-URI sent by the client. An attacker can apply to an arbitrary script outside of th...
Pizza Hut Japan Official Order App for Android. contains an issue where it fails to verify SSL server certificates
Overview Pizza Hut Japan Official Order App for Android. contains an issue where it fails to verify SSL server certificates. Shunsuke Taniguchi of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...
Sleipnir for Windows vulnerable to address bar spoofing
Overview Sleipnir for Windows contains an issue in displaying colors and the padlock icon on the address bar, which may result in the address bar being spoofed. Keita Haga of keitahaga.com reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...
ArtIME Japanese Input vulnerable to information disclosure
Overview ArtIME Japanese Input contains an issue in the access permissions for the certain files. ArtIME Japanese Input is a Japanese Input Method Editor IME for Android devices. ArtIME Japanese Input contains an issue in the access permissions for the certain files. Gaku Mochizuki of Mitsui Buss...
NEC Universal RAID Utility fails to restrict access permissions
Overview NEC Universal RAID Utility contains an issue where access permissions are not restricted. NEC Universal RAID Utility is a software to manage a RAID controller. NEC Universal RAID Utility contains an issue where access permissions are not restricted. SAKURA Internet Inc. reported this...