Cybozu Garoon Email Read Vulnerability (CNVD-2016-03720)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, etc. and supports free switching among three languages Chinese, Japanese, and English. A security vulnerability exists in Cybozu Garoon...

Cybozu Garoon Open Redirect Vulnerability

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. An open redirection vulnerabilit...

Cybozu Garoon Security Bypass Vulnerability

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A security vulnerability exists ...

Unspecified Vulnerability in Lenovo SHAREit

Lenovo SHAREit 茄子快传 on Android is a set of file-sharing software based on the Android platform by the Chinese company Lenovo Lenovo. An unspecified vulnerability exists in Lenovo SHAREit versions prior to 3.5.98ww, based on Android platforms prior to version 4.2. A remote attacker can exploit thi...

WordPress 4.2-4.5.1 - MediaElement.js Reflected Cross-Site Scripting (XSS)

...

DSA-3548-2 samba - regression update

Bulletin has no description...

DEBIAN-CVE-2016-2057

lib/xymondipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions 666 for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue...

CVE-2016-2056

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the addusername argument in 1 web/useradm.c or 2 web/chpasswd.c...

Code injection

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the addusername argument in 1 web/useradm.c or 2 web/chpasswd.c...

CVE-2016-2054

Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute arbitrary code or cause a denial of service daemon crash via a long filename, involving handling a "config" command...

CVE-2016-2056

xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the addusername argument in 1 web/useradm.c or 2 web/chpasswd.c...

Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability

Document Title: =============== Perli v2.6 iOS - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1813 Release Date: ============= 2016-04-05 Vulnerability Laboratory ID VL-ID: ====================================...

Possible remote code execution vulnerability in Action Pack

There is a possible remote code execution vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2016-2098. Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x Not affected: 5.0+ Fixed Versions: 3.2.22.2, 4.1.14.2, 4.2.5.2 Impact ------ Applications that pass unverifi...

Fortinet FortiADC Model D < 4.2 Theme Login Page XSS

The remote FortiADC Model D device is running a software version less than 4.2. It is, therefore, affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to the theme login page. An attacker can exploit this, via a specially crafted request, to execute...

CVE-2015-7580

Cross-site scripting XSS vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node...

CVE-2015-7579

Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class...

CVE-2015-7580

The CVE-2015-7580 entry describes an XSS vulnerability in the rails-html-sanitizer gem prior to 1.0.3 used with Ruby on Rails 4.2.x and 5.x. The issue arises in lib/rails/html/scrubbers.rb where a crafted CDATA node can inject arbitrary script/HTML. Affected component: rails-html-sanitizer (Ruby ...

Alcatel Lucent Home Device Manager Cross Site Scripting

Document Title: =============== Alcatel Lucent Home Device Manager - Management Console Multiple XSS CVE-Number: =========== CVE-2015-8687 Release Date: ============= 03 Jan 2016 Abstract Advisory Information: ============================= Ugur Cihan Koc discovered ten Reflected XSS vulnerabiliti...

UBUNTU-CVE-2015-8027

Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service uncaughtException and service outage via a pipelined HTTP request...

SAP Business Object Data Services - directory traversal

Application: SAP Data Services 4.2 Vendor URL: SAP Bug: Directory Travesal Reported: 01.02.2016 Vendor response: 02.02.2016 Date of Public Advisory: 14.06.2016 Reference: SAP Security Note 2300346 Author: Nursultan Abubakirov ERPScan VULNERABILITY INFORMATION Class: directory traversal Impact:...