Cisco Prime Infrastructure Java Deserialization RCE (cisco-sa-20160406-remcode)

The Cisco Prime Infrastructure application running on the remote host is affected by a remote code execution vulnerability due to improper sanitization of HTTP user-supplied input. An unauthenticated, remote attacker can exploit this, via an HTTP POST request with crafted deserialized user data, ...

MS16-040: Security Update for Microsoft XML Core Services (3148541)

The remote Windows host is affected by a remote code execution vulnerability in the Microsoft XML Core Services MSXML parser due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this vulnerability, by convincing a user to visit a specially-crafted...

PHP 5.5.x < 5.5.34 / 5.6.x < 5.6.20 / 7.0.x < 7.0.5 Multiple Vulnerabilities

Binary data 9171.prm...

Debian DSA-3544-1 : python-django - security update

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-2512 Mark Striemer discovered that some user-supplied redirect URLs containing basic authentication...

Debian Security Advisory DSA 3544-1 (python-django - security update)

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2512 Mark Striemer discovered that some user-supplied redirect URLs containing basic authentication...

PHP 5.6.x < 5.6.20 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.20. It is, therefore, affected by multiple vulnerabilities : - A buffer over-write condition exists in the finfoopen function due to improper validation of magic files. An unauthenticated, remote...

Fortinet FortiOS Redirect Parameter Multiple Vulnerabilities

The remote host is running a version of Fortinet FortiOS that is affected by the following vulnerabilities : - An open redirect vulnerability exists due to improper validation of user-supplied input before using it in redirects. An attacker can exploit this, via a specially crafted link, to...

Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability

A vulnerability in the Cisco Unified Communications Domain Manager Unified CDM could allow an authenticated, remote attacker to execute a cross-site scripting XSS attack. The vulnerability is due to insufficient input validation of user-supplied input. An attacker could exploit this vulnerability...

ManageEngine Desktop Central 8 / 9 < Build 91100 Multiple RCE

The ManageEngine Desktop Central application running on the remote host is version 8, or else version 9 prior to build 91100. It is, therefore, affected by multiple remote code execution vulnerabilities : - A flaw exists in the statusUpdate script due to a failure to properly sanitize user-suppli...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

ObjectMessage: unsafe deserialization

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

VMware ESX / ESXi Tools Update Privilege Escalation (VMSA-2010-0018) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by an unspecified flaw in the Tools update functionality due to improper validation of user-supplied input. A local attacker with host operating system access can exploit this flaw to gain root...

Updated python-django packages fix security vulnerability

Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. CVE-2016-2512 Sjoerd Job Postmus discovered that Djan...

phpMyAdmin 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-6, PMASA-2016-7)

Binary data 9116.prm...

PHP < 5.4.43, 5.5.x < 5.5.27, 5.6.x < 5.6.11 Multiple Vulnerabilities (Mar 2016) - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0011) (remote check)

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper sanitization of user-supplied input. A remote attacker can exploit this, via a specially crafted checkpoint file, to corrupt memory, resulting in a denial of...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0009) (remote check)

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities : - Multiple privilege escalation vulnerabilities exist due to improper handling of RPC commands. A local attacker guest user can exploit these to manipulate data and function pointers, resulting in a denial of service...

phpMyAdmin 4.4.x < 4.4.15.3 / 4.5.x < 4.5.4 Multiple Vulnerabilities (PMASA-2016-6, PMASA-2016-7)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.4.x prior to 4.4.15.3 or 4.5.x prior to 4.5.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists in the AES.php and...

LibreOffice < 5.0.5 Multiple RCE

The version of LibreOffice installed on the remote Windows host is prior to 5.0.5. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper validation of user-supplied input when handling LotusWordPro LWP documents. A remote attacker...