Elastic Stack 6.2.4 and 5.6.9 security update

X-Pack Machine Learning XSS vulnerability ESA-2018-06 X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. Users with manageml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to...

iu.edu XSS vulnerability

Vulnerable URL: https://www.iu.edu/uirr/reports/standard/factbook/2016-17/Southeast/AdditionalFacts/UITS/ITUsage/%22%3Etrolo%3Ci%3Etralala%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS...

CVE-2017-3824

A vulnerability in the handling of list headers in Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition. Cisco cBR-8 Converged Broadband Routers running vulnerable versions of Cis...

CVE-2017-3824

Cisco CVE-2017-3824 affects Cisco cBR Series Converged Broadband Routers (notably cBR-8) running Cisco IOS XE. The vulnerability is caused by memory corruption in the handling of list headers, allowing an unauthenticated, remote attacker to cause the device to reload and crash (DoS) by sending cr...

CVE-2016-3824

omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827...

CVE-2016-3824

omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827...

CVE-2016-3824

omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827...

CVE-2016-3824

CVE-2016-3824 covers a Mediaserver elevation of privilege flaw in Android’s mediaserver (libstagefright), where OMXNodeInstance.cpp in OMX buffer port handling is unvalidated. A crafted application could exploit this local issue to gain privileges. Affected are Android 4.x before 4.4.4, 5.0.x bef...

Integer overflow

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an...

CVE-2015-3824

The entry CVE-2015-3824 concerns MPEG4Extractor::parseChunk in Android’s libstagefright (mediaserver). The flaw arises when processing MP4 tx3g atoms, where size calculations are not properly bounded, enabling remote attackers to cause memory corruption and potentially remote code execution or a ...

CVE-2015-3864

CVE-2015-3864 is a remote-code-execution vulnerability in Android’s mediaserver (libstagefright). It arises from an integer underflow when parsing the MPEG-4 tx3g chunk in the Stagefright parser, enabling crafted MPEG-4 data to corrupt memory. The issue is tied to an incomplete fix for CVE-2015-3...

CVE-2014-3824

Cross-site scripting XSS vulnerability in the web server in the Juniper Junos Pulse Secure Access Service SSL VPN devices with IVE OS 8.0 before 8.0r6, 7.4 before 7.4r13, and 7.1 before 7.1r20 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3824

CVE-2014-3824 describes a cross-site scripting (XSS) vulnerability in the web server of Juniper Junos Pulse Secure Access Service (SSL VPN) devices using IVE OS. The issue stems from incorrect user input validation on the SSL VPN web page, potentially enabling an attacker to inject arbitrary scri...

CVE-2013-3824

The CVE-2013-3824 entry concerns Oracle Supply Chain Products Suite 9.3.1, specifically the Oracle Agile Collaboration Framework component. It describes an unspecified vulnerability that allows remote authenticated users to affect integrity via unknown vectors related to Manufacturing/Mfg Parts. ...

CVE-2011-3824

Your Own URL Shortener YOURLS 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files...

CVE-2011-3824

The CVE-2011-3824 issue affects Your Own URL Shortener (YOURLS) 1.5, where a direct request to a PHP file can disclose installation path information via an error message (e.g., includes/auth.php and similar files). Root cause: error disclosure leaking path details through PHP error handling. Impa...

CVE-2010-3824

The CVE-2010-3824 issue is a Use-After-Free in WebKit used by Apple Safari. Affected: Safari prior to 5.0.3 on macOS X 10.5–10.6 and Windows, and prior to 4.1.3 on macOS X 10.4. Root cause: use-after-free in WebKit when processing SVG use elements. Impact: remote code execution or denial of servi...

Fedora 12 : horde-3.3.6-1.fc12 (2010-5520)

Upgrade to 3.3.6 - Fixes a lot of security bugs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 13 : horde-3.3.6-1.fc13 (2010-5563)

Upgrade to 3.3.6 - Fixes a lot of security bugs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)

Upgrade to 3.3.6 - Fixes a lot of security bugs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...