Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20170921)

Security Fixes : - It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man- in-the-middle attack and retrieve information in plain-text. CVE-2017-12150 - An information leak flaw was found in the way SMB1 protocol...

PYSEC-2017-45

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

Cross site scripting

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

PYSEC-2017-45

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

CVE-2015-4706

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

CVE-2015-4706

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

CVE-2015-4706

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

CVE-2015-4706

CVE-2015-4706 affects IPython 3.x before 3.2. It is a cross-site scripting (XSS) vulnerability where remote attackers can inject arbitrary web script or HTML via JSON error messages and the /api/contents path. Connected advisories (GHSA, OSV, CNVD/NVD variants) consistently describe the same issu...

Block Screen capture option in MDX policies for IOS devices

Question : Block Screen capture option is not available in SecureMail MDX policies for IOS devices. Answer :​ Block screen capture option is available only on Android and not on iOS. Any option which is not available under MDX policies is by default On. Hence the Screen capture/snapshots will be...

Microsoft Edge Information Disclosure Vulnerability (CNVD-2017-27430)

Microsoft Windows 10 is a set of next-generation cross-platform operating systems released by Microsoft Corporation in the U.S. It is available for PCs and laptops, tablets, and cell phones, among other devices.Microsoft Edge is one of the default browsers that comes with the system. An informati...

The vulnerability of the PostgreSQL database management system, caused by authentication flaws, allows a hacker to trigger a system failure.

The vulnerability of the PostgreSQL database management system arises from deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to rewrite the contents of objects without appropriate privileges, thereby causing a system failure...

Design/Logic Flaw

An XXE issue was discovered in Automated Logic Corporation ALC Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser...

PYSEC-2017-105

Apache Atlas versions 0.6.0 incubating, 0.7.0 incubating, and 0.7.1 incubating allow access to the webapp directory contents by pointing to URIs like /js and /img...

CVE-2017-7548

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service...

Mystery Company Offers $250,000 Bounty for VM Escape Vulnerabilities

An unnamed company will start an eight-week, invite-only bug bounty program in September that offers a $250,000 payout for virtual-machine escape vulnerabilities tied to an unreleased product. Bugcrowd announced the program today, and said the high-priced bounty is the largest advertised bounty o...

CVE-2017-8037: Incomplete fix for Cloud Controller API access to CC VM Contents | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Versions Affected CAPI-release versions after v1.6.0 and prior to v1.38.0 cf-release versions after v244 and prior to v270 Description This CVE is for an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should als...

Access Restrictions Bypass

moodle/moodle is vulnerable to access restriction bypass. The bypass is possible because it does not properly handle availability dates, allowing any authenticated users to perform unauthorized read to SCORM contents...

REDDOXX Appliance Build 2032 / 2.0.625 - Arbitrary File Disclosure Vulnerability

Exploit for jsp platform in category web applications Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated attackers to list...

REDDOXX Appliance Build 2032 / 2.0.625 - Arbitrary File Disclosure

Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated attackers to list directory contents and download arbitrary file...

REDDOXX Appliance Build 2032 2.0.625 - Arbitrary File Disclosure

REDDOXX Appliance Build 2032 2.0.625 - Arbitrary File Disclosure Advisory: Arbitrary File Disclosure with root Privileges via RdxEngine-API in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated...