Debian DLA-412-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2015-7566 Ralf Spenneberg of OpenSource Security reported that the visor driver crashes when a specially crafted USB device without bulk-out endpoint is detected. CVE-2015-8767 An SCTP denial of service was discovered which can be triggered by a loc...

[SECURITY] [DLA 412-1] linux-2.6 security update

Package : linux-2.6 Version : 2.6.32-48squeeze19 CVE ID : CVE-2015-7566 CVE-2015-8767 CVE-2015-8785 CVE-2016-0723 CVE-2016-2069 This update fixes the CVEs described below. CVE-2015-7566 Ralf Spenneberg of OpenSource Security reported that the visor...

DLA-412-1 linux-2.6 - security update

Bulletin has no description...

CVE-2015-5310

CVE-2015-5310 affects wpa_supplicant 2.x prior to 2.6. The WNM Sleep Mode code does not properly ignore key data in response frames when MFP was not negotiated, allowing remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service via a WNM Sleep Mode response....

[SECURITY] [DLA 378-1] linux-2.6 security update

Package : linux-2.6 Version : 2.6.32-48squeeze18 CVE ID : CVE-2015-7550 CVE-2015-8543 CVE-2015-8575 Debian Bug : 808293 This update fixes the CVEs described below. CVE-2015-7550 Dmitry Vyukov discovered a race condition in the keyring subsystem that allows a local...

FCKeditor 2.6 /fckeditor/editor/filemanager/connectors/uploadtest.html 文件上传漏洞

No description provided by source...

Debian DLA-360-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2013-7446 Dmitry Vyukov discovered that a particular sequence of valid operations on local AFUNIX sockets can result in a use-after-free. This may be used to cause a denial of service crash or possibly for privilege escalation. CVE-2015-7799...

[SECURITY] [DLA 360-1] linux-2.6 security update

Package : linux-2.6 Version : 2.6.32-48squeeze17 CVE ID : CVE-2013-7446 CVE-2015-7799 CVE-2015-7833 CVE-2015-7990 CVE-2015-8324 This update fixes the CVEs described below. CVE-2013-7446 Dmitry Vyukov discovered that a particular sequence of valid...

CVE-2015-8125

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the 1 Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or 2...

CVE-2015-8124

Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id...

CVE-2015-8125

CVE-2015-8125 affects Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7. It describes a potential remote timing-attack vulnerability in the Symfony Security Remember-Me service (PersistentTokenBasedRememberMeServices), the DigestAuthenticationListener, and the legacy CSRF i...

DLA-360-1 linux-2.6 - security update

Bulletin has no description...

Centreon 2.6.x < 2.6.2 File Upload RCE

According to its version number, the Centreon application hosted on the remote web server is 2.6.x prior to 2.6.2. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of user-uploaded files via the main.php script. An authenticated, remote attacker can...

MAYO theme - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-164

MAYO theme enables you to change certain theme settings via the administration interface. Some theme settings aren't sufficiently sanitized. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer themes". CVE identifiers issued CVE-2015-8233...

Infinite Automation Mango Automation Cross-Site Request Forgery Vulnerability

Infinite Automation Mango Automation is the United States Infinite Automation Systems, Inc. of a set of open source Web-based SCADA data acquisition and supervisory control, HMI and automation software. Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430, suffers from a...

Infinite Automation Mango Automation Cross-Site Scripting Vulnerability

Infinite Automation Mango Automation is the United States Infinite Automation Systems, Inc. of a set of open source Web-based SCADA data acquisition and supervisory control, HMI and automation software. A cross-site scripting vulnerability exists in Infinite Automation Mango Automation 2.5.x and...

Infinite Automation Mango Automation Information Disclosure Vulnerability (CNVD-2015-07171)

Infinite Automation Mango Automation is the United States Infinite Automation Systems, Inc. of a set of open source Web-based SCADA data acquisition and supervisory control, HMI and automation software. An information disclosure vulnerability exists in Infinite Automation Mango Automation 2.5.x...

CVE-2015-7902

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests...

Information disclosure

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests...

CVE-2015-7902

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests...