Cisco Prime Home Authentication Bypass Vulnerability

Cisco Prime Home is a standards-based remote management and configuration solution from Cisco. The solution provides a unified view of the home connected devices visibility, reduce the cost of home network operations and improve the user experience and other features. An authentication bypass...

OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...

CVE-2016-0239

IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with administrator privileges via unspecified vectors...

OpenJDK: insufficient checks of JDWP packets (Hotspot, 8159519)

It was discovered that the Hotspot component of OpenJDK did not properly check received Java Debug Wire Protocol JDWP packets. An attacker could possibly use this flaw to send debugging commands to a Java program running with debugging enabled if they could make victim's browser send HTTP request...

IBM Sterling Secure Proxy Configuration Manager Man-in-the-Middle Attack Vulnerability

IBM Sterling Secure Proxy SSP is an unprotected zone DMZ-based application proxy from IBM USA that protects file transfers from the public Internet.Configuration Manager is one of the configuration management components. A man-in-the-middle attack vulnerability exists in Configuration Manager in...

Server Side Request Forgery (SSRF) Vulnerability in AVTECH DVRs

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. AVTECH DVR suffers from a server-side request forgery SSRF vulnerability. search.cgi provides search and access services for...

CVE-2016-5945

IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request...

Cisco Web Security Appliance AsyncOS Denial of Service Vulnerability (CNVD-2016-07730)

Cisco AsyncOS on Web Security Appliance WSA is a set of operating systems running in Web Security Appliance WSA from Cisco USA. A denial of service vulnerability exists in AsyncOS 9.5.0-444 and earlier versions on the Cisco WSA appliance. A remote attacker could exploit this vulnerability by...

CVE-2016-6407

Cisco AsyncOS through 9.5.0-444 on Web Security Appliance WSA devices allows remote attackers to cause a denial of service link saturation by making many HTTP requests for overlapping byte ranges simultaneously, aka Bug ID CSCuz27219...

CVE-2016-6909

Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER...

Cisco IP Phone 8800 Series Denial of Service Vulnerability

Cisco IP 8800 Series Phones are digital phone system products. A denial of service vulnerability exists in the Web Server of the Cisco IP Phone 8800 Series. A remote attacker could exploit this vulnerability to cause a denial of service by sending an HTTP request to an affected device...

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker coul...

PT-2016-4806 · Cisco · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center versions 4.x through 5.3.0.2, 5.3.1.x through 5.3.1.1, and 5.4.x through 5.4.0.0 Cisco Adaptive Security Appliance ASA Software on 5500-X devices with FirePOWER Services versions 4.x through 5.3.0.2, 5.3.1.x...

Foreman: API permits HTTP requests when require_ssl is enabled

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the requiressl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack...

The vulnerability of the Windows operating system allows a remote attacker to execute arbitrary code within the system account context.

The vulnerability of the HTTP.sys driver on Windows operating systems, which implements the HTTP protocol, lies in the improper handling of HTTP requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the system account’s context. To exploit this...

The vulnerability of Cisco ASA software allows a malicious actor to induce a service failure.

The vulnerability in the implementation of SSL VPN for Cisco’s multi-functional security devices ASA allows malicious actors to bypass authentication by using specially crafted HTTP POST requests, along with values of cookies or URLs that have been altered...

UBUNTU-CVE-2016-5097

phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading 1 HTTP requests or 2 server logs...

The vulnerability of the Pidgin instant messaging system allows a remote attacker to trigger a service denial or execute arbitrary code.

The Pidgin software contains a vulnerability in the processchukeddata function. Exploiting this vulnerability allows a malicious actor to cause a service failure or execute arbitrary code by manipulating HTTP requests...

CVE-2016-1395

The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID CSCux82428...

CVE-2016-1391

Cisco Prime Network Analysis Module NAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 and Prime Virtual Network Analysis Module vNAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID...