Multiple Vulnerabilities in Cisco Prime Collaboration Assurance

Cisco Prime Collaboration Assurance Software contains the following vulnerabilities: Cisco Prime Collaboration Assurance Web Framework Access Controls Bypass Vulnerability Cisco Prime Collaboration Assurance Information Disclosure Vulnerability Cisco Prime Collaboration Assurance Session ID...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions...

Moderate: Red Hat Security Advisory: python-django security update

Updated python-django packages that fix two security issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores...

Moderate: Red Hat Security Advisory: python-django security update

Updated python-django packages that fix two security issues are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores...

Django任意代码执行

SECRETKEY作用 SECTETKEY在djanog中使用非常广泛，基本上涉及到安全，加密等的地方都用到了，下面列举一些常见情景： 1，json object的签名 2，加密函数，如密码重置，表单，评论，csrf的key，session数据 这里面就要重点讲到session的问题，在这里使用不当就会导致代码执行 代码执行 settings的session设置 django默认存储session到数据库中，但是可能会比较慢，就会使用到缓存，文件，还有cookie等方式，如果采用了cookie机制则有可能代码执行，settings配置如下： SESSIONENGINE =...

Moderate: Red Hat Security Advisory: python-django security update

Updated python-django packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Moderate: Red Hat Security Advisory: python-django security update

Updated python-django packages that fix a security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Django Denial of Service Vulnerability (CNVD-2015-05667)

Django is a set of Django Software Foundation based on the Python language open source Web application framework. A denial of service vulnerability exists in Django that allows remote attackers to cause a denial of service...

The vulnerability of the Cisco UCS Central operating system, allowing a hacker to read arbitrary files

The vulnerability of the Cisco UCS Central operating system’s web framework exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to read arbitrary files using a specially crafted HTTP request...

Cisco TelePresence Video Communication Server Command Injection Vulnerability

A vulnerability in the web framework in the Cisco TelePresence Video Communication Server VCS could allow an authenticated, remote attacker to inject arbitrary commands that are executed at the nobody privilege level. The vulnerability is due to insufficient input validation. An attacker could...

CVE-2015-4286

The web framework in Cisco UCS Central Software 1.30.99 allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377...

Cisco UCS Central Software File Access Vulnerability

A vulnerability in the web framework of the Cisco UCS Central Software could allow an unauthenticated, remote attacker to download arbitrary files from a targeted device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted HTTP...

CVE-2015-4274

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified Intelligence Center 10.01 and 10.61 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936...

CVE-2015-4274

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Unified Intelligence Center 10.01 and 10.61 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936...

CVE-2015-4267

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

CVE-2015-4267

Cross-site request forgery CSRF vulnerability in the web framework in Cisco Identity Services Engine ISE 1.20.793, 1.30.876, 1.40.109, 2.00.147, and 2.00.169 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus09940...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack against the user of the web interface. The vulnerability is due to insufficient CSRF protections. An attacker could exploit th...

Zend zend-diactoros has multiple vulnerabilities

Zend Framework is a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services . zend-diactoros is an implementation of PSR-7 HTTP messages . A cross-site scripting vulnerability and an open redirection vulnerability exists in Zend...

Cisco Unified Communications Domain Manager Information Disclosure Vulnerability

Cisco Unified Communications Domain Manager UCDM is the United States Cisco Cisco company developed a dedicated call processing components in the unified communications solution. The component has scalable, distributable, and highly available enterprise voice-over-IP call processing capabilities....

CVE-2015-4229

Cisco Unified Communications Domain Manager 8.1(4)ER1 contains an information-disclosure vulnerability in the web framework (bvsmweb directory) that allows unauthenticated remote attackers to obtain sensitive information due to insufficient access controls (Bug ID CSCuq22589). Multiple sources (C...