CVE-2015-5212

Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code vi...

HackerOne: HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com

The subdomain info.hackerone.com is vulnerable to HTTP header injection. I'm aware that you are only interested in critical issues affecting this subdomain. However, you may be interested in this issue as a vulnerability in this domain may affect the domain hackerone.com. The vulnerability is a...

CVE-2015-2552: Undefined Security Weakness

The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows physically proximate attackers to bypass the Trusted Boot protection mechanism, and consequently interfere with the integrity of code, BitLocker, Device Encryption, and...

MS15-111: Security Update for Windows Kernel to Address Elevation of Privilege (3096447)

The remote Windows host is affected by the following vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the Windows kernel due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, via a specially crafted application, to execute...

Oracle: Security Advisory (ELSA-2014-3002)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2013-0276)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-5869

The Neighbor Discovery ND protocol implementation in the IPv6 stack in Apple iOS before 9 allows remote attackers to reconfigure a hop-limit setting via a small hoplimit value in a Router Advertisement RA message...

Here's How to Stop Windows 7 or 8 from Downloading Windows 10 Automatically

Yesterday we reported you that Microsoft is auto-downloading Windows 10 installation files — between 3.5GB and 6GB — onto users' PCs even if they have not opted into the upgrade. Microsoft plans to deploy Windows 10 on over 1 Billion devices worldwide, and this auto-downloading Windows 10 could b...

Fedora 23 : rolekit-0.4.0-4.rc1.fc23 (2015-14897)

rolekit-0.4.0-3.rc1.fc23 - Added support for installing roles through kickstart - Added support for providing setting values through stdin - Enabled deploying Domain Controller and Database Server with no mandatory options - New API feature: sanitize which will remove sensitive information from t...

Fedora 23 : mediawiki-1.25.2-2.fc23 (2015-13920)

T94116 SECURITY: Compare API watchlist token in constant time T97391 SECURITY: Escape error message strings in thumb.php T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia...

Sysax Multi Server 6.40 - SSH Component Denial of Service

''' Exploit title: Sysax Multi Server 6.40 ssh component denial of service vulnerability Date: 29-8-2015 Vendor homepage: http://www.sysax.com Software Link: http://www.sysax.com/download/sysaxservsetup.msi Version: 6.40 Author: 3unnym00n Details: ---------------------------------------------- by...

Adobe Flash - scale9Grid Use-After-Free

Adobe Flash - scale9Grid Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then...

Change this Facebook Privacy Setting That Could Allow Hackers to Steal Your Identity

Facebook User: Who Can Find Me...? Hacker: Yes, I CAN!! A Security Researcher claimed “digi-crims could easily scan the population of an entire country to find targets”. Reza Moaiandin, technical director at Salt Agency, has figured out a way to exploit an important Facebook feature to gather...

WordPress arcResBookingWidget 1.0 Cross Site Scripting Vulnerability

WordPress arcResBookingWidget plugin version 1.0 suffers from a cross site scripting vulnerability. Title: WordPress 'arcResBookingWidget' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/arcres-booking-engine/ -...

USN-2704-1 swift vulnerabilities

Rajaneesh Singh discovered Swift does not properly enforce metadata limits. An attacker could abuse this issue to store more metadata than allowed by policy. CVE-2014-7960 Clay Gerrard discovered Swift allowed users to delete the latest version of object regardless of object permissions when...

WordPress arcResBookingWidget 1.0 Cross Site Scripting

Title: WordPress 'arcResBookingWidget' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/arcres-booking-engine/ - https://plugins.svn.wordpress.org/arcres-booking-engine/ Notified Vendor/WordPress: 2015-06-21...

MGASA-2015-0281 Updated apache package fixes security vulnerabilities

The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension...

chromium-browser: Settings allowed executable files to run immediately after download in unsepcified

Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to...

CVE-2015-3185

The apsomeauthrequired function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions ...

CVE-2015-3185

The apsomeauthrequired function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions ...