About the security content of Xcode 8.1 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Apple Xcode < 8.1 Node.js Multiple RCE (macOS)

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a...

About the security content of Xcode 8.1

About the security content of Xcode 8.1 This document describes the security content of Xcode 8.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

F5 Networks BIG-IP : NodeJS vulnerability (K15311661)

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. CVE-2016-2086 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CVE-2016-2086

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header...

UBUNTU-CVE-2016-2086

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header...

CVE-2016-2086

CVE-2016-2086 affects Node.js HTTP request parsing via Content-Length mishandling, enabling remote HTTP request smuggling. Public docs identify Node.js versions affected (0.10.x up to 0.10.42, 0.12.x up to 0.12.10, 4.x up to 4.3.0, 5.x up to 5.6.0) and describe impact as potential for cache poiso...

Fedora 23 : nodejs-0.10.42-4.fc23 (2016-3102c11757)

Security fix for CVE-2016-2216, CVE-2016-2086 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 22 : nodejs-0.10.42-4.fc22 (2016-8925b6119f)

Security fix for CVE-2016-2216, CVE-2016-2086 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

openSUSE Security Update : nodejs (openSUSE-2016-283)

This update for nodejs fixes the following issues : - CVE-2016-2216: Response splitting vulnerability using Unicode characters boo966076 - CVE-2016-2086: Request smuggling vulnerability boo966077 Node.js was updated to the 4.3.1 LTS version, containing all upstream bug fixes and improvements...

Fedora Update for nodejs FEDORA-2016-3102

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

February 2016 Security Release Summary

February 2016 Security Release Summary Two weeks ago we announced the planned release of updates to all active release lines, v0.10, v0.12, v4 and v5, to fix HTTP related vulnerabilities and to upgrade the bundled versions of OpenSSL. Upon release of the OpenSSL updates we posted an impact...

Oracle: Security Advisory (ELSA-2015-2086)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2015-2086)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2086 advisory. 1:1.6.0.35-1.13.9.4.0.1.el511 - Add oracle-enterprise.patch 1:1.6.0.37-1.13.9.4 - Update with new IcedTea & b37 tarballs, including fix for...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...

CVE-2015-2086

CVE-2015-2086 describes an XSS vulnerability in the live preview of the Panopoly Magic module for Drupal 7.x, prior to 7.x-1.17. The issue arises from insufficient filtering of the pane title during re‑rendering of the preview, allowing remote authenticated users to inject arbitrary scripts/HTML....

SA-CONTRIB-2015-047 - Panopoly Magic - Cross Site Scripting (XSS)

This module enables live previews of Panels panes in the modal dialog for adding or editing them. The module doesn't sufficiently filter the pane title when re-rendering the live preview. This vulnerability is mitigated by the fact that an attacker must have permission to add or edit Panels panes...

Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow

No description provided by source. $Id: junipersslvpnivesetupdll.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

CVE-2013-2086

The CVE-2013-2086 issue affects ownCloud 5.0.x prior to 5.0.6, where the configuration loader writes CSRF tokens (and other private data) into an accessible JavaScript file. This leakage enables remote attackers to obtain CSRF tokens and other sensitive information, per the official advisory and ...