The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a perpetrator to read arbitrary files or cause a service failure.

The vulnerability of the Call Policy Configuration module in the Cisco TelePresence Video Communication Server software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to read arbitrary files or trigger a service failure using specially...

The vulnerability of Cisco Adaptive Security Appliance’s network firewall, which allows attackers to bypass the uPRF inspection mechanism

The vulnerability of the Unicast Reverse Path Forwarding uRPF protection mechanism in Cisco Adaptive Security Appliances exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the uRPF mechanism, which is designed to protect against I...

PayPal - Mobile Security Approval Auth Bypass Vulnerability

Document Title: =============== PayPal - Mobile Security Approval Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1485 Video: https://www.youtube.com/watch?v=Gzq8TD2Co9Y Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1486 Release...

Cisco TelePresence Video Communication Server Expressway Privilege Gain Vulnerability

Cisco TelePresence Video Communication Server VCS Expressway is a TelePresence video communication server from Cisco that integrates with Unified Communications and voice communication environments to provide the best possible experience for end users using a variety of communication tools. A...

Cisco Unified Web Interaction Manager Web Interface Denial of Service Vulnerability

Cisco Unified Web Interaction Manager is a WEB interaction manager. An input validation vulnerability in Cisco Unified Web Interaction Manager allows remote attackers to conduct denial of service attacks by deleting the default system folder in the message queue via the WEB interface...

Cisco Unified Web Interaction Manager Web Interface Security Restriction Bypass Vulnerability

Cisco Unified Web Interaction Manager is a WEB interaction manager. An input validation vulnerability in Cisco Unified Web Interaction Manager WEBjiekou could be exploited by a remote attacker to submit a special request to view, modify, or delete data stored on the target system...

The vulnerability of the Apache HTTP Server web server allows attackers to trigger a service failure.

The vulnerability of the luawebsocketread function in the luarequest.c component of the Apache HTTP Server exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failure by sending a specially crafted WebSocket Ping reques...

The vulnerability of Google Chrome browser allows a perpetrator to trigger a service failure.

The vulnerability of the LocalFrame::isURLAllowed function core/frame/LocalFrame.cpp in the Google Chrome browser component exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to trigger a service failure by using a specially crafted Java scrip...

Webservice-DIC yoyaku_v41 Unauthorized Operation Vulnerability

Webservice-DIC yoyakuv41 is a conference room reservation management software from Webservice-DIC. Webservice-DIC yoyakuv41 fails to properly filter user-submitted input, which allows remote attackers to bypass authentication by submitting a special request to complete a conference room reservati...

UBUNTU-CVE-2015-4652

epan/dissectors/packet-gsmadtap.c in the GSM DTAP dissector in Wireshark 1.12.x before 1.12.6 does not properly validate digit characters, which allows remote attackers to cause a denial of service application crash via a crafted packet, related to the deemergnumlist and debcdnum functions...

The vulnerability of VMware Player allows a hacker to trigger a service failure in the guest or host operating system.

The vulnerability of VMware Player exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to trigger a service failure for a 32-bit guest operating system or a 64-bit host operating system using a specially crafted RPC request...

Design/Logic Flaw

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."...

Symantec Endpoint Protection Management Console SQL Injection Vulnerability

Symantec Endpoint Protection is a protection software developed to enhance enterprise virus protection and advanced threat defense. Symantec Endpoint Protection management console fails to properly validate user input and administrators with low privileges can perform SQL injection attacks with...

Design/Logic Flaw

CA Common Services, as used in CA Client Automation r12.5 SP01, r12.8, and r12.9; CA Network and Systems Management r11.0, r11.1, and r11.2; CA NSM Job Management Option r11.0, r11.1, and r11.2; CA Universal Job Management Agent; CA Virtual Assurance for Infrastructure Managers aka SystemEDGE 12....

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

It was found that the SecurityTokenService STS, provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens...

UBUNTU-CVE-2015-3146

The 1 SSHMSGNEWKEYS and 2 SSHMSGKEXDHREPLY packet handlers in packagecb.c in libssh before 0.6.5 do not properly validate state, which allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted SSH packet...

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

A flaw was found in the way PicketLink's Service Provider SP and Identity Provider IdP handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was...

PYSEC-2015-9

The utils.http.issafeurl function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting XSS attacks via a control character in a URL, as demonstrated by a...

Nullsoft Scriptable Install System Inetc Plugin Security Bypass Vulnerability

Nullsoft Scriptable Install System NSIS is the United States Nullsoft company's set of script-based open source system used to create Windows installer. Inetc Internet client is one of the Internet to provide file upload and download plug-ins. A security vulnerability exists in the Inetc plug-in...

kernel: splice: lack of generic write checks

A flaw was found in the way the Linux kernel's splice system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system...