CVE-2015-3755

CVE-2015-3755 affects WebKit in Apple Safari (and WebKit-based components used in iOS before 8.4.1 and other products): WebKit could be induced to spoof the user interface via a malformed URL, enabling a remote attacker to mislead users. Affected versions include Safari before 6.2.8, 7.x before 7...

CVE-2015-3755

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL...

FreeBSD : RT -- two XSS vulnerabilities (83b38a2c-413e-11e5-bfcf-6805ca0b3d42)

Best Practical reports : RT 4.0.0 and above are vulnerable to a cross-site scripting XSS attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopec at Data Reliance Shared Service Center. RT 4.2.0 and above a...

Cross site scripting

Cross-site scripting XSS vulnerability in the DHCP Monitor page in the Web User Interface WebUI in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname...

CVE-2015-3626

Summary: CVE-2015-3626 is an XSS flaw in Fortinet FortiOS FortiGate WebUI, specifically the DHCP Monitor page. Affected: FortiOS versions prior to 5.2.4. Cause: insufficient input filtering on the DHCP hostname field allows injection of arbitrary script/HTML. References from NVD/NVD-listed detail...

CVE-2015-3626

Cross-site scripting XSS vulnerability in the DHCP Monitor page in the Web User Interface WebUI in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname...

Unspecified Vulnerability in Oracle Siebel Enterprise Siebel UI Framework Component (CNVD-2015-04723)

Oracle Siebel is a customer relationship management software. A security vulnerability exists in the Oracle Siebel Siebel Core - Server OM Svcs component, which can be exploited by remote attackers to compromise system integrity...

Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability

-------------------------------------------------------- Snorby 2.6.2 - Stored Cross-site Scripting Vulnerability -------------------------------------------------------- Vendor ------ https://www.snorby.org/ Version ------- 2.6.2 Description ----------- During my research and testing of new IDS...

D-Link DNS Devices Authentication Bypass Vulnerability

Authentication bypass vulnerability in D-Link DNS devices. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:dlink";...

abrt: default abrt event scripts lead to information disclosure

It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged use...

Huawei Home Gateway HG530 / HG520b Password Disclosure / Change

---- Exploit 1 ---- getRouterPassHuaweiHG530.py: ! /usr/bin/python import socket import sys import re if lensys.argv !=2: print " Please enter the target ip." print " Usage : " + sys.argv0 + " IPADDR" exit Create a TCP/IP socket targethost = sys.argv1 sock = socket.socketsocket.AFINET,...

UBUNTU-CVE-2015-1266

content/browser/webui/contentwebuicontrollerfactory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as...

Schneider Electric InduSoft Web Studio < 7.1.3.4 Multiple Information Disclosures (SEVD-2015-054-01)

Binary data scadaindusoftwebstudioSEVD2015-054-01.nbin...

Multiple Blue Coat Systems SSL Visibility Appliance Product Session Fixation Vulnerabilities

Blue Coat Systems SSL Visibility Appliance SV800 and others are SSL visibility appliances from Blue Coat Systems, USA, that are at the heart of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL inspection capabilities to advanced threat...

Multiple Blue Coat Systems SSL Visibility Appliance Product Sensitive Information Vulnerabilities

Blue Coat Systems SSL Visibility Appliance SV800 and others are SSL visibility appliances from Blue Coat Systems, USA, which are at the heart of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL inspection capabilities to advanced threat...

Multiple Blue Coat Systems SSL Visibility Appliance Product Information Disclosure Vulnerabilities

Blue Coat Systems SSL Visibility Appliance SV800 and others are SSL visibility appliances from Blue Coat Systems, USA, which are at the heart of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL inspection capabilities to advanced threat...

Multiple Blue Coat Systems SSL Visibility Appliance Products Cross-Site Request Forgery Vulnerabilities

The Blue Coat Systems SSL Visibility Appliance SV800 is a management appliance that provides complete visibility into encrypted traffic from Blue Coat Systems, USA. The appliance provides a dedicated encrypted traffic management platform, easy-to-use policy enforcement points and adaptive securit...

Xxe

The web-based user interface in Cisco Unified MeetingPlace 8.61.9 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue, aka Bug ID CSCus97452...

Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability

A vulnerability in the web-based user interface of Cisco Unified MeetingPlace could allow an authenticated, remote attacker to gain read access to select information stored on the affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file...

Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability

A vulnerability in the Web Tracking Report page of the Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to perform a cross-site scripting XSS attack against the user of the web interface. The vulnerability is due to improper validation of user-supplied input in a...