CVE-2017-4928

CVE-2017-4928 affects the Flash-based vSphere Web Client (not the HTML5 client). The issue stems from improper neutralization of URLs, enabling SSRF and CRLF injection that could allow an attacker to send a crafted POST request towards internal services and disclose information. Affected VMware p...

CVE-2017-4928: Cross-Site Request Forgery (CSRF)

The flash-based vSphere Web Client 6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers toward...

VMware vCenter Server Information Disclosure Vulnerability (CNVD-2017-33977)

VMware vCenter Server provides a centralized, scalable platform for managing virtual infrastructure. An information disclosure vulnerability exists in VMware vCenter Server versions 5.5, 6.0, and 6.5. A remote user can trigger the URL authentication vulnerability by sending a specially crafted PO...

KLA11142 DoS and OSI vulnerabilities in VMware products

Multiple serious vulnerabilities have been found in VMware vCenter Server and vSphere Web Client. Malicious users can exploit these vulnerabilities to cause denial of service or disclose sensetive information. Below is a complete list of vulnerabilities: 1. An unspecified vulnerability in VMware...

Unspecified Spoofing Vulnerability in SAP Customer Relationship Management (CRM) IC WebClient

SAP Customer Relationship Management is a customer relationship management solution. An unspecified spoofing vulnerability exists in SAP Customer Relationship Management CRM IC WebClient, which can be exploited by attackers to conduct spoofing attacks and perform unauthorized operations...

SAP Customer Relationship Management (CRM) WebClient UI Cross-Site Scripting Vulnerability

SAP Customer Relationship Management is a customer relationship management solution. A cross-site scripting vulnerability exists in the SAP Customer Relationship Management CRM WebClient UI. A remote attacker could exploit the vulnerability to execute arbitrary script code in an unsuspecting user...

hawtio: Proxy is sharing cookies among all the clients

It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

CVE-2017-10039

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite subcomponent: Web Client. Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

Design/Logic Flaw

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite subcomponent: Web Client. Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

CVE-2017-10039

The CVE-2017-10039 issue affects Oracle Agile PLM Web Client in Oracle Supply Chain Products Suite, specifically versions 9.3.5 and 9.3.6. The vulnerability allows a low-privileged, network-accessible attacker (via HTTP) to compromise Oracle Agile PLM, with successful attacks requiring user inter...

CVE-2017-10039: Undefined Security Weakness

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite subcomponent: Web Client. Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

Oracle Agile PLM Remote Vulnerability (CNVD-2017-26392)

Oracle Supply Chain Products Suite is a set of supply chain solutions from Oracle, which provides value chain planning, value chain execution, product lifecycle management, etc. Oracle Agile PLM Product Lifecycle Management is one of the lifecycle management components. Oracle Agile PLM Product...

OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

CVE-2017-5151

An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution...

CVE-2017-5151

An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution...

CVE-2017-5151

An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution...

CVE-2017-5151: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution...

VideoInsight Web Client

CVSS V3 7.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: VideoInsight Equipment: Web Client Vulnerability: SQL Injection AFFECTED PRODUCTS The following Web Client versions are affected: Web Client Version 6.3.5.11 and previous versions. IMPACT A successful exploit of this...