The vulnerability of the Reporting Compatibility Add-On module of the OpenMRS Reference Application, which allows a violator to execute arbitrary code.

The vulnerability of the Reporting Compatibility Add-On module of the OpenMRS Reference Application, which is used for working with medical records, stems from the lack of an authentication process during deserialization of XML files into ReportSchema objects. Exploiting this vulnerability allows...

Google to Ditch Public Key Pinning in Chrome

Google said that in an upcoming version of Chrome it will deprecate the browser’s support for HTTP public key pinning. Instead, it will adopt the “safer” more flexible solution of Expect-CT headers. HTTP public key pinning HPKP is a browser security measure that protects against an SSL certificat...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

Cross site request forgery (csrf)

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The CVE-2017-12796 issue affects the OpenMRS Reporting Compatibility Add On prior to 2.0.4 (distributed in the OpenMRS Reference Application prior to 2.6.1). It does not authenticate users during XML deserialization into ReportSchema objects, allowing remote unauthenticated users to execute opera...

A simple example of a complex cyberattack

We're already used to the fact that complex cyberattacks use 0-day vulnerabilities, bypassing digital signature checks, virtual file systems, non-standard encryption algorithms and other tricks. Sometimes, however, all of this may be done in much simpler ways, as was the case in the malicious...

[SECURITY] Fedora 25 Update: q-7.11-29.fc25

Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced application...

[SECURITY] Fedora 26 Update: q-7.11-29.fc26

Q is a powerful and extensible functional programming language based on the term rewriting calculus. You specify an arbitrary system of equations which the interpreter uses as rewrite rules to reduce expressions to normal form. Q is useful for scientific programming and other advanced application...

Automated Logic WebCTRL 6.5 - Unrestricted File Upload / Remote Code Execution

!/usr/bin/env python -- coding: utf8 -- Automated Logic WebCTRL 6.5 Unrestricted File Upload Remote Code Execution Vendor: Automated Logic Corporation Product web page: http://www.automatedlogic.com Affected version: ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior ALC WebCTRL, SiteScan Web 6.1 and...

PHP Object Injection

Moodle is vulnerable to PHP object injection and arbitrary code execution. The repositories component of Moodle contains a flaw which allows these attacks through serialized data containing objects defined in an add-on...

EulerOS 2.0 SP1 : firefox (EulerOS-SA-2016-1085)

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or,...

Boat Web2PDF Add-on - External URLs, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Boat Web2PDF Add-on published at the 'play' market has multiple vulnerabilities...

CVE-2017-5982

Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e encoded dot dot slash in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd...

UBUNTU-CVE-2017-5982

Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e encoded dot dot slash in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd...

IBM Tealeaf Customer Experience on Cloud Network Capture Add-On Information Disclosure Vulnerability

IBM Tealeaf Customer Experience is a SaaS Software-as-a-Service based web and mobile application analytics solution from IBM in the U.S. IBM Tealeaf Customer Experience on Cloud Network Capture Add-On is a hybrid cloud environment for the IBM IBM Tealeaf Customer Experience on Cloud Network Captu...

CVE-2016-5900

CVE-2016-5900 affects IBM Tealeaf Customer Experience on Cloud Network Capture Add-On 16.1.01. The vulnerability stems from improper validation of TLS certificates, enabling a remote attacker to obtain sensitive information via man‑in‑the‑middle techniques over the network. The IBM Security Bulle...

Mozilla Firefox ESR < 45.5 Multiple Vulnerabilities

Binary data 9805.prm...

Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20161116)

This update upgrades Firefox to version 45.5.0 ESR. Security Fixes : - Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox...

CentOS Update for firefox CESA-2016:2780 centos6

Check for the Version of firefox SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882592";...