CVE-2016-10278

CVE-2016-10278 is listed in the Android 2017-05-01 bulletin as a High-severity vulnerability in Qualcomm components, affecting Pixel and Pixel XL. The entry notes the issue is tied to Qualcomm internal references (QC-CR#1043004) and that a patch is not publicly available; the fix is provided only...

CVE-2016-10240

CVE-2016-10240 is listed in the 2017 Android bulletin as a Qualcomm component vulnerability with a Nexus 6P impact. The entry shows the issue as Critical and notes a Qualcomm-internal reference with no publicly available patch details. The connected Android bulletin confirms the vulnerability is ...

CVE-2016-3942

CVE-2016-3942 details in connected docs pertain to a remote code execution in the JavaScript template engine jsrender . Affected versions are vulnerable when server-delivered client-side templates dynamically embed user input, enabling an attacker to execute arbitrary code through crafted templat...

CVE-2016-1000228

Summary: The provided connected advisories describe a DOM-based XSS vulnerability in the npm package Gmail.js (gmail-js). Affected versions contain unsafe handling in the functions tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post, which pass user input directly...

CVE-2016-1000238

The CVE-2016-1000238 entry is linked to node-krb5 SPOOFING via unvalidated KDC. Affected: node-krb5 (Node.js module). Issue: KDC is not validated before authentication, allowing a network-attacker with time and access to spoof the KDC and impersonate a valid user without credentials. Impact: pote...

CVE-2016-1000224

The connected advisories describe a vulnerability in ezseed-transmission: affected versions download/run a script over HTTP, enabling a privileged-network attacker to perform a Man‑in‑the‑Middle attack and replace the script with malicious code, compromising the system running ezseed-transmission...

CVE-2016-1000249

The CVE entry relates to fury-adapter-swagger. Versions 0.2.0 through 0.9.7 contain a weakness that allows an attacker to read arbitrary files from the system (e.g., /etc/passwd) and can cause a DoS by reading sensitive data or exhausting memory. Remediation: upgrade to version 0.9.7 or later. Th...

CVE-2016-1000233

CVE-2016-1000233 is a Swagger-UI cross-site scripting vulnerability described in the connected IBM bulletin. The issue arises when a Content-Type: application/javascript header is included while Swagger-UI processes a URL query string parameter, allowing a remote attacker to inject and execute ma...

CVE-2016-1000225

The connected advisories identify a SQL Injection vulnerability in Sequelize involving models with the GEOMETRY DataType and GeoJSON handling. Specifically, unescaped single quotes in GeoJSON documents processed by ST_GeomFromGeoJSON (and GeomFromText for MySQL) allow injection in affected models...

CVE-2016-1000230

CVE-2016-1000230 : The connected advisories describe an XSS vulnerability in the client-side rendering of Rendr templates inside a _block, with server-side rendering unaffected. Affected versions of Rendr are vulnerable to cross-site scripting when client-side rendering occurs in that block conte...

CVE-2016-1000231

The CVE placeholder CVE-2016-1000231 is linked to a real issue in the emoji rendering library emojione. Affected versions are vulnerable to cross-site scripting (XSS) when user input is fed into functions such as toShort(), shortnameToImage(), unicodeToImage(), and toImage(). The root cause is im...

CVE-2016-1000227

CVE-2016-1000227 is a reserved placeholder entry; connected advisories describe a cross-site scripting vulnerability in bootstrap-tagsinput. All versions are affected by unsanitized input passed to the itemTitle parameter, leading to XSS. The issue is not actively maintained (last updates circa 2...

CVE-2016-1000242

The connected advisories describe a Denial of Service in the mqtt package (GHSA-HG78-C92R-HVWR / OSV entry). Affected mqtt versions crash the Node.js process when handling specially crafted MQTT packets, leading to a DoS. Remediation: upgrade to v1.0.0 or later. References include GitHub Advisory...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2022-1177)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Security Network Intrusion Prevention System is affected by a vulnerability in OpenSSL (CVE-2016-2183)

Summary IBM Security Network Intrusion Prevention Systems has addressed the following vulnerability in OpenSSL. The vulnerability is known as the SWEET32 Birthday attack CVE-2016-2183. Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitiv...

Security Bulletin: A vulnerability in the GSKit component of IBM Security Network Intrusion Prevention System (CVE-2016-0201)

Summary A vulnerability has been addressed in the GSKit component of IBM Security Network Intrusion Prevention System. Vulnerability Details CVEID: CVE-2016-0201 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a MD5 collision. An attacker could...

Ex-Crypto CEO accused of 2016’s $11 billion Ethereum DAO hack

By Waqas According to journalist Laura Shin and Blockchain data security firm Chainalysis, in 2016, a programmer, Toby Hoenisch, allegedly… This is a post from HackRead.com Read the original post: Ex-Crypto CEO accused of 2016s $11 billion Ethereum DAO hack...

SAP NetWeaver AS JAVA XML External Entity Injection (CVE-2016-9563)

An XML external entity injection vulnerability exists in SAP NetWeaver. Successful exploitation of this vulnerability could result in the disclosure of file contents from the target system...

EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1177)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Control and Tivoli Storage Productivity Center October 2015 CPU and January 2016 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ Technology Edition that is shipped and used by IBM Spectrum Control and Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in October...