10927 matches found
EUVD-2016-6371
PowerDNS aka pdns Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service backend CPU consumption via a long qname...
Multiple Design Logic Vulnerabilities in BageCMS Content Management System Backend
BageCMS is a multi-functional open source web content management system based on php5+mysql5 development. Two design logic vulnerabilities exist in the BageCms 3.1.3 backend, allowing attackers to exploit the vulnerabilities to gain server privileges...
SQL Injection Vulnerability in the Backend of Armitage Website Management System
Jingxun CMS is a website construction and management system by Taizhou Jingxun Information Technology Co. A SQL injection vulnerability exists in the backend of the 2.1 Simplified Chinese version of the Armitage CMS, due to the system not filtering the $attachment parameter. This vulnerability...
SUSE-SU-2016:2325-1 Security update for openstack-keystone, openstack-nova, and openstack-swift
This update for openstack-keystone, openstack-nova, and openstack-swift fixes the following issues: - Fix hybrid backend from keystone v3 bsc967356 - Fix cleanup when block migration fails bsc960015 - Avoid host data leak bsc960601, CVE-2015-7548 - Fix init script for openstack-swift-object-expir...
Cross-Site Scripting in TYPO3 Backend
It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting Component Type: TYPO3 CMS Release Date: September 13, 2016 Vulnerability Type: Cross-Site Scripting Affected Versions: 6.2.0 to 6.2.26, 7.6.0 to 7.6.10 and 8.0.0 to 8.3.0 Severity: Low Suggested CVSS v2.0:...
Open-Xchange App Suite 7.8.2 - Cross-Site Scripting
Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...
Mercenary Linux
Mercenary-Linux is a “new-era” lightweight distribution of mostly Dockerized tools built for field expedient hunting, forensics, and malware analysis. This problem birthed MHF Mercenary Hunt Framework which allows the hunt team to easily perform hunt operations within a framework that aggregates...
Jobberbase 2.0 - Multiple Vulnerabilities
Exploit for php platform in category web applications Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...
CURL-CVE-2016-7141 Incorrect reuse of client certificates
libcurl built on top of NSS Network Security Services incorrectly reused client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection. While the symptoms are similar to CVE-2016-5420 Reusing connection with wrong client cert...
Unauthorized Access Vulnerability in Zhongke Dayang 3GLive Multimedia Gateway
ZTE 3GLive multimedia is relying on 3G network technology to provide a new means of live broadcasting. Unauthorized access vulnerability exists in the 3GLive Multimedia Gateway, which can be exploited by unauthorized attackers to access /monitor?lan=1 to directly enter the backend...
SUSE SLES12 Security Update : apache2 (SUSE-SU-2016:2090-1) (httpoxy)
This update for apache2 fixes the following issues : - It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...
TYPO3 Backend Subcomponent Information Disclosure Vulnerability
TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. An information disclosure vulnerability exists in TYPO3 Backend Subcomponent. It allows attackers to exploit the vulnerability to obtain sensitive information...
TYPO3 Backend Subcomponent Cross-Site Scripting Vulnerability
TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 Backend Subcomponent. Because the program fails to properly filter user-supplied input, an attacker may be able to exploit the vulnerability to...
Security update for the Linux Kernel (important)
The openSUSE 13.1 kernel was updated to 3.12.62 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2014-9904: The sndcompresscheckinput function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel did not properly check for an integer...
SUSE-SU-2016:2090-1 Security update for apache2
This update for apache2 fixes the following issues: - It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...
Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047
Panels does not check access on some routes Critical Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not...
Zabbix 2.2. x, 3.0. x latest.php SQL injection vulnerability
Zabbix insertDBinjection vulnerabilities analysis Vulnerability linkage: https://www.seebug.org/vuldb/ssvid-92302 A vulnerability overview 1. Vulnerability description Zabbix is a WEB-based interface to provide distributed system monitoring and network monitoring capabilities of enterprise-class...
CVE-2016-6597
Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability...
CVE-2016-6597
Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability...