May 3, 2016, update for InfoPath 2013 (KB3114946)

None None...

May 3, 2016, update for InfoPath 2013 (KB3114818)

None None...

The vulnerability of the PostgreSQL database management system allows attackers to circumvent existing access restrictions.

The vulnerability of the PostgreSQL database management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using a session that executes queries from more than one role...

SAP Manufacturing Integration Intelligence Cross-Site Scripting Vulnerability

SAP Manufacturing Integration Intelligence also known as MII, formerly known as xMII is a set of Germany's SAP SAP will be the core of the manufacturing system and enterprise process integration platform. A cross-site scripting vulnerability in SAP Manufacturing Integration Intelligence allows...

The vulnerability of microprogrammed software in HP networking switches allows attackers to circumvent existing access restrictions.

The vulnerability of microprogrammed software in HP Networking switches is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder operating locally to circumvent existing access restrictions...

The vulnerability of the ZyXEL PMG5318-B20A router allows a violator to circumvent existing access restrictions.

The vulnerability of the ZyXEL PMG5318-B20A router exists due to the absence of session termination after exiting the system. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions by using an automated workstation...

UBUNTU-CVE-2016-2313

authlogin.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database...

DEBIAN-CVE-2015-8553

Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777...

UBUNTU-CVE-2015-0861

model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records...

Lenovo Fingerprint Manager and Touch Fingerprint Privilege Gain Vulnerability

Lenovo Fingerprint Manager and Touch Fingerprint are both products of the Chinese company Lenovo. The former is a set of fingerprint sensor drivers developed for the Thinkpad series; the latter is a set of drivers for acquiring recognized fingerprints. A privilege-acquisition vulnerability exists...

KLA10782 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet explorer and Microsoft Edge. For details look at KLA10780. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: disable Adobe Flash Player,...

CVE-2016-2171

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to 1 add, 2 edit, or 3 delete users via the REST API...

Hack the Pentagon DOD Bug Bounty

MIAMI—Lisa Wiswell’s phone rang off the hook last summer in the throes of the OPM hack. But she wasn’t just answering questions from those whose security clearance and personal data disappeared into the Chinese ether; there were also hackers on the other end of the line offering their help...

Rollout or Not: the Benefits and Risks of iOS Remote Hot Patching

Previously On iOS Remote Hot Patching Apple’s detailed app review process has resulted in greater security for iOS apps made available through the App Store. However, this review process can be lengthy, which negatively impacts developers who need to quickly patch a buggy or insecure app. As a...

Linux kernel Advanced Linux Sound Architecture Framework Competitive Conditions Vulnerability

Linux kernel is an open source operating system. A contention condition vulnerability exists in timer ioctls, the Advanced Linux Sound Architecture framework for Linux kernel, which can be exploited by a local attacker to cause the system to hang, resulting in a denial-of-service attack...

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software allows a perpetrator to circumvent existing access restrictions based on RBAC.

The vulnerability of the NX-OS network operating system and the Application Policy Infrastructure Controller software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions using a...

The vulnerability of the Firefox browser allows a perpetrator to obtain confidential information or circumvent existing access restrictions policies.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or obtain confidential information by accessing the Content Security Policy violation report...

Microsoft built a special version of Windows 10 just for Chinese Government

China is very strict about censorship, which makes it difficult for companies to launch their products in the country. But companies like Microsoft are playing smartly to target the largest market in the world. Microsoft has found a way to enter into the banned Chinese Market, but this time with...

Security feature bypass

IBM Tivoli NetView Access Services NVAS allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls in the NVAS product...

CVE-2014-9768

IBM Tivoli NetView Access Services NVAS allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls in the NVAS product...