SUSE-SU-2016:2005-1 Security update for Linux Kernel Live Patch 8 for SLE 12

This update for the Linux Kernel 3.12.48-5227 fixes several issues. The following security bugs were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

Barracuda Web App Firewall 8.0.1.007/Load Balancer 5.4.0.004 - (Authenticated) Remote Command Execution (Metasploit)

Exploit Title: Barracuda Web App Firewall/Load Balancer Post Auth Remote Root Exploit 2 Date: 07/25/16 Exploit Author: xort [email protected] Vendor Homepage: https://www.barracuda.com/ Software Link: https://www.barracuda.com/products/loadbalance &...

Drupal Open Atrium Notifications Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability in Drupal Open Atrium Notifications allows remote attackers to submit special requests to obtain sensitive information...

The vulnerability of the Cisco Evolved Programmable Network Manager, a software tool for managing network services, and the Cisco Prime Infrastructure, a tool for managing network lifecycle, allows a attacker to load files or execute arbitrary commands.

The vulnerability of the Cisco Evolved Programmable Network Manager, a software tool for managing network services, and the Cisco Prime Infrastructure, a tool for managing network lifecycle, exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicio...

tidy-html5 Remote Denial of Service Vulnerability

tidy-html5 is a set of HTML tools that provide standard support for HTML5 pages. A security vulnerability exists in tidy-html that allows remote attackers to exploit the vulnerability to submit a special request and crash the application...

Drupal RESTWS Module Remote PHP Code Execution

This module exploits a Remote PHP Code Execution vulnerability in the Drupal RESTWS Module. Unauthenticated users can execute arbitrary code under the context of the web server user. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this...

The vulnerability of Microsoft SharePoint’s electronic document management system, which allows a malicious individual to increase their privileges

The Microsoft SharePoint electronic document management program contains a vulnerability related to the improper filtering of specially crafted requests sent to the server. Exploiting this vulnerability allows a malicious user, after authenticating, to elevate their privileges by sending a...

The vulnerability of the SAP NetWeaver Application Server allows a perpetrator to compromise the security of information.

The vulnerability of SAP NetWeaver Application Server is related to errors in the processing of XML requests. Exploiting this vulnerability allows a malicious actor to compromise information security by sending specially crafted TCP and XML requests remotely...

The vulnerability of the WebSphere Application Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in IBM WebSphere Application Server allows malicious actors, operating remotely, to trigger a service failure excessive resource consumption by sending a specially crafted request to the web service endpoint...

Vulnerabilities in the nginx software allow a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the implementation of SPDY in the ngxhttpspdymodule module of nginx when running on 32-bit platforms allows malicious actors to execute arbitrary code using specially crafted requests...

The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to execute arbitrary code.

The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control when processing the cookiesName value with a placeholder. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending ...

Vulnerability of Cisco IOS software, which allows a malicious actor to trigger a service failure

The vulnerability in the SSL VPN function known as WebVPN in Cisco IOS allows malicious actors to trigger a service failure excessive memory consumption by using specially crafted HTTP requests...

The vulnerability in Microsoft.NET Framework software allows a malicious attacker to compromise the accessibility of protected information.

A vulnerability that can lead to service failure exists in the Microsoft.NET Framework and is related to the processing of specially crafted requests that trigger hash collisions. Exploiting this vulnerability allows an attacker to send a small number of specially crafted requests to the.NET...

The vulnerability of the Firefox ESR browser allows a malicious attacker to execute arbitrary code.

Mozilla Firefox ESR’s software contains a vulnerability in the nsDocShell::InternalLoad function. Exploiting this vulnerability allows an attacker to execute arbitrary code by performing “cross-site scripting” attacks using specially crafted network requests...

The vulnerability of the Cisco IOS operating system, which allows a malicious actor to trigger a service failure

Cisco IOS software contains vulnerabilities in the Secure Shell SSH services and Cisco IOS XE software. When these services are operated, a “disruption of service” can be triggered by sending specially crafted SSH requests...

The vulnerability of WebSphere Application Server application servers allows a remote attacker, after passing authentication, to gain access to confidential information.

The IBM WebSphere Application Server software contains a vulnerability that, if exploited, allows a malicious actor who has passed authentication to gain access to confidential information by using specially crafted requests...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the DNS Server component of the Windows operating system is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted requests...

Cisco IOS XE on cBR-8 Converged Broadband Router IOS XE Denial of Service Vulnerability

Cisco IOS XE on cBR-8 Converged Broadband Router is an operating system from Cisco that runs on the cBR-8 series of routers. A denial of service vulnerability exists in Cisco IOS XE on cBR-8 Converged Broadband Router devices in Cisco IOS XE version 3.15S and 3.16S. A remote attacker could use th...

Double free

Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Server Use After Free Vulnerability."...

CVE-2016-3227

Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Server Use After Free Vulnerability."...