[SECURITY] [DSA 3766-1] mapserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3766-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2017 https://www.debian.org/security/faq -...

Star Tracker - Mobile Sky Map - Dangerous filesystem permissions, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Star Tracker - Mobile Sky Map published at the 'play' market has multiple vulnerabilities...

QNAP NAS Devices - Heap Overflow

================== 1 Heap overflow ================== Path: /home/httpd/cgi-bin/cgi.cgi u = valid user guest|admin 1.1 / Remote / Remote host echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=fori=0;i263;i++;do echo -en "A";done HTTP/1.0\nHost: QNAP\n\n" | ncat --ssl 192.168.5.7 443 HTTP/1.1 200 OK Date:...

UBUNTU-CVE-2016-9036

An exploitable incorrect return value vulnerability exists in the mpcheck function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mpcheck function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer...

DEBIAN-CVE-2016-9036

An exploitable incorrect return value vulnerability exists in the mpcheck function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mpcheck function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer...

IT Threat GeoDashboard: Suspicious

IT Threat GeoDashboard Suspicious is a combination of Open Source software configured to give end users a view on IT threats over an interactive geographical dashboard. You’ll just need an Internet Browser to access the dashboard. This application has been build on a GNU/Linux environment and may...

ip-geolocation-map-bing NSE Script

This script queries the Nmap registry for the GPS coordinates of targets stored by previous geolocation scripts and renders a Bing Map of markers representing the targets. The Bing Maps REST API has a limit of 100 markers, so if more coordinates are found, only the top 100 markers by number of IP...

ip-geolocation-map-google NSE Script

This script queries the Nmap registry for the GPS coordinates of targets stored by previous geolocation scripts and renders a Google Map of markers representing the targets. Additional information for the Google Static Maps API can be found at: - See also: ip-geolocation-geoplugin.nse...

Mozilla Firefox ESR 45.x < 45.6 Multiple Vulnerabilities

The version of Mozilla Firefox ESR installed on the remote Windows host is 45.x prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exist, such as when handling document state changes or HTML5 content, or else due to dereferencing alrea...

LocalTapiola: Reflected XSS on sankarikoulutus (viestinta.lahitapiola.fi)

Basic report information Summary: Hi, The ctx parameter in http://viestinta.lahitapiola.fi/webApp/sankarikoulutus, can be exploited to perform an XSS Attack. Description: When a user clicks on a map area, The following POST request is generated : POST / HTTP/1.1 Host: viestinta.lahitapiola.fi...

Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox 50.1, Firefox...

CVE-2016-9904

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox 50.1, Firefox...

[ASA-201612-15] firefox: multiple issues

Arch Linux Security Advisory ASA-201612-15 ========================================== Severity: Critical Date : 2016-12-14 CVE-ID : CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-99...

UBUNTU-CVE-2016-9904

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox 50.1, Firefox...

DEBIAN-CVE-2016-7422

The virtqueuemapdesc function in hw/virtio/virtio.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash via a large I/O descriptor buffer length value...

UBUNTU-CVE-2016-9839

In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails...

Debian DLA-734-1 : mapserver security update

It was discovered that there was an information leakage vulnerability in mapserver, a CGI-based framework for Internet map services. For Debian 7 'Wheezy', this issue has been fixed in mapserver version 6.0.1-3.2+deb7u3. We recommend that you upgrade your mapserver packages. NOTE: Tenable Network...

parkplatzvergleich.de XSS vulnerability

Open Bug Bounty ID: OBB-196161 Description| Value ---|--- Affected Website:| parkplatzvergleich.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Wordpress Olimometer 2.56 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Olimometer Plugin for WordPress – Sql Injection Date: 14/11/2016 Exploit Author: TAD GROUP Vendor Homepage: https://wordpress.org/plugins/olimometer/ Software Link: https://wordpress.org/plugins/olimometer/ Contact:...

UBUNTU-CVE-2016-9077

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox 50...