Nextcloud: Files Drop: WebDAV endpoint is leaking existence of resources

The new WebDAV endpoint implementation in 11 is leaking too many informations if one executes a MKCOL or a PUT against an existing item. With Files Drop one should only be able to upload files but not leak any existence of items. Leaking existence using PUT When doing a PUT the expectation is to...

VMware Fusion 8.x < 8.5.2 Drag-and-Drop Feature Arbitrary Code Execution (VMSA-2016-0019)

The version of VMware Fusion installed on the remote Mac OS X host is 8.x prior to 8.5.2. It is, therefore, affected by an arbitrary code execution vulnerability in the drag-and-drop feature due to an out-of-bounds memory access error. An attacker within the guest can exploit this to execute...

VMware Workstation 12.x < 12.5.2 Drag-and-Drop Feature Arbitrary Code Execution (VMSA-2016-0019) (Linux)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.2. It is, therefore, affected by an arbitrary code execution vulnerability in the drag-and-drop feature due to an out-of-bounds memory access error. An attacker within the guest can exploit this to execute...

CVE-2016-6357

A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. More Information:...

CVE-2016-6357

A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. More Information:...

CVE-2016-6357

CVE-2016-6357 affects Cisco AsyncOS for the Cisco Email Security Appliance (ESA). The issue is a vulnerability in configured security policies, including drop email filtering, where an unauthenticated, remote attacker could bypass a configured drop filter by sending an email with a corrupted atta...

PT-2016-6841

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA versions 9.7.1-066 through 10.0.9-015, 9.9.6-026 Description A vulnerability in the configured security policies of Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote...

CVE-2016-6357: Undefined Security Weakness

A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. More Information:...

Cisco Email Security Appliance Drop Bypass Vulnerability

A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass a configured drop filter by using an email with a corrupted attachment. The vulnerability is due t...

Google Chrome < 54.0.2840.59 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 54.0.2840.59. It is, therefore, affected by multiple vulnerabilities as referenced in the 201610stable-channel-update-for-desktop advisory. - Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. CVE-2016-5194...

Google Chrome < 54.0.2840.59 Multiple Vulnerabilities

Binary data 9687.pasl...

Mozilla Firefox Sensitive Information Disclosure Vulnerability (CNVD-2016-08176)

Mozilla Firefox is an open source web browser. A vulnerability in Mozilla Firefox's handling of drag-and-drop operations can be exploited by remote attackers to construct a malicious web page that can be parsed to obtain full-pathname information...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3076-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3076-1 advisory. Atte Kettunen discovered an out-of-bounds read when handling certain Content Security Policy CSP directives in some circumstances. If a user...

CVE-2016-5279

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

CVE-2016-5279

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

CVE-2016-5279

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

CVE-2016-5279: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

UBUNTU-CVE-2016-5279

Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code...

Mozilla Firefox < 49.0 Multiple Vulnerabilities

The version of Mozilla Firefox installed on the remote Windows host is prior to 49.0. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists within file dom/security/nsCSPParser.cpp when handling content security policies CSP containing empty referrer...

PT-2016-6339

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 49.0 Description The issue allows remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code. This can be achieved when a user is...