UBUNTU-CVE-2016-5348

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service memory consumption, and device hang or reboot via a large xtra.bin or xtra2.bin file on a spoofed...

CVE-2016-5348

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service memory consumption, and device hang or reboot via a large xtra.bin or xtra2.bin file on a spoofed...

PT-2016-6379

Name of the Vulnerable Software and Affected Versions Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-10-01 Android versions 7.0 before 2016-10-01 Description The issue allows man-in-the-middle attackers...

CVE-2016-5348: Undefined Security Weakness

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service memory consumption, and device hang or reboot via a large xtra.bin or xtra2.bin file on a spoofed...

CVE-2016-6840

Cross-site scripting XSS vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attackers to inject arbitrary web script or HTML via the loginName parameter to cgi-bin/doLoginCgiEntry and possibly other unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attackers to inject arbitrary web script or HTML via the loginName parameter to cgi-bin/doLoginCgiEntry and possibly other unspecified vectors...

CVE-2016-6840: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attackers to inject arbitrary web script or HTML via the loginName parameter to cgi-bin/doLoginCgiEntry and possibly other unspecified vectors...

PT-2016-7134

Name of the Vulnerable Software and Affected Versions Huawei OceanStor ISM versions prior to V200R001C04SPC200 Description A cross-site scripting XSS issue exists in the management interface, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the loginName...

FreeBSD : openssh -- sshd -- remote valid user discovery and PAM /bin/login attack (adccefd1-7080-11e6-a2cb-c80aa9043978)

The OpenSSH project reports : sshd8: Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari...

Command injection

cgi-bin/cgimain in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transferlicense command...

Updated openssh packages fix security vulnerability

The dosetupenv function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pamenvironment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as...

PT-2016-6636

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.6 through 3.0.0 NETGEAR ReadyNAS Surveillance version 1.1.2 Description The issue is a stack-based buffer overflow in the cgi-bin/cgi main component. It allows remote authenticated users to execute arbitrary code vi...

PT-2016-6632

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 2.x NUUO NVRsolo versions 1.7.5 through 2.x NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue allows remote attackers to reset the administrator password via a...

CVE-2016-5679: Improper Neutralization of Special Elements used in an OS Command

cgi-bin/cgimain in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transferlicense command...

PT-2016-6620

Name of the Vulnerable Software and Affected Versions Accellion Kiteworks appliances versions prior to kw2016.03.00 Description The issue allows local users to gain privileges via unspecified vectors due to the use of setuid-root permissions for /opt/bin/cli. Recommendations For versions prior to...

CVE-2016-5662: Undefined Security Weakness

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

Honeywell IP-Camera Detection

Detects the installed version of Honeywell IP-Cameras. This script sends an HTTP GET request and tries to ensure the presence of Honeywell IP-Cameras. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

MESSOA NIC990 IP-Camera Authentication Bypass

MESSOA NIC990 IP-Camera auth bypass configuration download Copyright 2016 c Todor Donev http://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is for Educational purpose ONLY. Do not use it without permission. The usual disclaimer applies,...

Debian DSA-3643-1 : kde4libs - security update

Andreas Cord-Landwehr discovered that kde4libs, the core libraries for all KDE 4 applications, do not properly handle the extraction of archives with '../' in the file paths. A remote attacker can take advantage of this flaw to overwrite files outside of the extraction folder, if a user is tricke...

Crestron AirMedia AM-100 cgi-bin/login.cgi Directory Traversal Vulnerability

The Crestron AirMedia AM-100 is a gateway product from Crestron Electronics, USA. A directory traversal vulnerability in the cgi-bin/login.cgi file in the Crestron AirMedia AM-100 device allows remote attackers to submit a special request to read arbitrary files...