1633 matches found
Design/Logic Flaw
There is an illegal address access in the extendaliastable function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service...
bind: Processing a response containing CNAME or DNAME with unusual order can crash resolver
A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...
CVE-2017-6086
Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...
CVE-2017-6086
CVE-2017-6086 concerns ViMbAdmin 3.0.15. The connected sources describe multiple cross-site request forgery (CSRF) vulnerabilities affecting administrator actions. The root causes are CSRF flaws in the following controller endpoints: DomainController.php (add/delete administrator, change password...
FAQ: XenMobile Derived Credentials
What are Derived Credentials? Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification PIV card or Common Access Card CAC. The derived...
openSUSE Security Update : lynis (openSUSE-2017-705)
This update for lynis fixes the following issues : Lynis 2.5.1 : - Improved detection of SSL certificate files - Minor changes to improve logging and results - Firewall tests: Determine if CSF is in testing mode The Update also includes changes from Lynis 2.5.0 : - CVE-2017-8108: symlink attack m...
CVE-2017-8441
The CVE-2017-8441 issue affects Elastic X-Pack Security: versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This could allow a user with restricted permissions to view data they should not access when performing certain operations against an...
Open Source Solutions ViMbAdmin Cross-Site Scripting Vulnerability
Open Source Solutions ViMbAdmin is an open source Web-based virtual mailbox management system from Open Source Solutions, Ireland. The system supports administrators to manage domains , mail and aliases and so on. A cross-site scripting vulnerability exists in Open Source Solutions ViMbAdmin...
ViMbAdmin 3.0.15 Cross Site Scripting
CVE-2017-5870 Multiple XSS vulnerabilities in ViMbAdmin Product Description ViMbAdmin is a web-based interface used to manage a mail server with virtual domains, mailboxes and aliases. It is an open source solution developed by Opensolutions and distributed under the GNU/GPL license version 3. Th...
CVE-2016-10160
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...
Postfixadmin Protected Alias Deletion Vulnerability
Postfixadmin installations between 2.91 and 3.0.1 do not check if an admin is allowed to delete protected aliases. This vulnerability can be used to redirect protected aliases to an other mail address. Eg. rewrite the postmaster@domain alias. Module Options msf use...
CVE-2016-10160
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...
Memory corruption
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...
CVE-2016-10160
CVE-2016-10160 is a PHP vulnerability in the PHAR handling path. The issue is an off-by-one memory corruption in ext/phar/phar.c (phar_parse_pharfile) that can be triggered by a crafted PHAR archive with an alias mismatch, leading to memory corruption and potentially remote code execution. Affect...
CVE-2016-10160
Removed by vendor...
UBUNTU-CVE-2016-10160
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...
CVE-2016-10160
Off-by-one error in the pharparsepharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch...
Adobe Reader DC XSLT namespace-alias Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within XSLT's...