FreeBSD : elasticsearch -- XSS vulnerability in the CORS functionality (5951fb49-1ba2-11e5-b43d-002590263bf5)

Elastic reports : Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss o...

Symantec Data Loss Prevention Enforce Server Administration Console Cross-site Scripting, Cross-site

SUMMARY Symantec's Data Loss Prevention DLP Management Console is potentially susceptible to persistent cross-site scripting XSS issues and a possible cross-site request forgery CSRF in the Enforce Server administration console. Successful exploitation could result in potential unauthorized actio...

Updated kernel-tmb packages fix security vulnerabilities and bugs

Updated kernel-tmb fixes security, critical data corruption and pdata loss issues This kernel-tmb update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues: drivers/vhost/scsi.c: potential memory corruption CVE-2015-4036 ext4...

MGASA-2015-0238 Updated kernel-tmb packages fix security vulnerabilities and bugs

Updated kernel-tmb fixes security, critical data corruption and pdata loss issues This kernel-tmb update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues: drivers/vhost/scsi.c: potential memory corruption CVE-2015-4036 ext4...

MGASA-2015-0237 Updated kernel-linus packages fix security vulnerabilities and bugs

Updated kernel-linus fixes security, critical data corruption and pdata loss issues This kernel-linus update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues: drivers/vhost/scsi.c: potential memory corruption CVE-2015-4036 ext4...

Updated kernel-linus packages fix security vulnerabilities and bugs

Updated kernel-linus fixes security, critical data corruption and pdata loss issues This kernel-linus update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues: drivers/vhost/scsi.c: potential memory corruption CVE-2015-4036 ext4...

MGASA-2015-0236 Updated kernel packages fix security vulnerabilities and bugs

Updated kernel fixes security, critical data corruption and pdata loss issues This kernel update is based on upstream -longterm 3.14.43 and fixes a security issue, and critical data corruption and data loss issues: drivers/vhost/scsi.c: potential memory corruption CVE-2015-4036 ext4 filesystem ha...

Android Factory Reset Improper Sanitization Exposes Data

The churn of Android devices, whether older smartphones being traded in or sold online, makes device sanitization imperative. The native feature in the OS, however, may not be doing as thorough a job as advertised. A paper, “Security Analysis of Android Factory Resets” pdf, published by Ross...

Mandriva Linux Security Advisory : glibc (MDVSA-2015:218)

Multiple vulnerabilities has been found and corrected in glibc : It was discovered that, under certain circumstances, glibc's getaddrinfo\ function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resultin...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The XFree86-font-utils-4.3.0 package in the Red Hat Enterprise Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remote...

Medium: glibc

Issue Overview: A buffer overflow flaw was found in the way glibc's gethostbynamer and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw t...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2015:0863 Updated glibc packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base...

glibc: getaddrinfo() writes DNS queries to random file descriptors under high load

It was discovered that, under certain circumstances, glibc's getaddrinfo function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application...

2015 Verizon Data Breach Investigations Report DBIR

The 2015 Verizon Data Breach Investigations Report DBIR did some mythbusting on two fronts: the estimated cost per record lost in a breach is much lower than reported elsewhere; and mobile malware is a no-go. The DBIR is Verizon’s annual data dump collected from breaches it has investigated, alon...

McAfee Data Loss Prevention Endpoint EPO Extended Cross-Site Request Forgery Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from the U.S. company McAfee McAfee. A cross-site request forgery vulnerability exists in the McAfee Data Loss Prevention Endpoint DLPe epo extension, which allows remote attackers to construct malicious...

McAfee Data Loss Prevention Endpoint EPO Extended Cross-Site Scripting Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from the U.S. company McAfee McAfee. The McAfee Data Loss Prevention Endpoint DLPe epo extension suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to inject...

McAfee Data Loss Prevention Endpoint EPO Extended Information Disclosure Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from the U.S. company McAfee McAfee. A security vulnerability in the McAfee Data Loss Prevention Endpoint DLPe epo extension allows remote attackers to submit a special URL request to obtain sensitive...

McAfee Data Loss Prevention Endpoint EPO Extended Denial of Service Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from the U.S. company McAfee McAfee. A security vulnerability in the McAfee Data Loss Prevention Endpoint DLPe epo extension allows a remote attacker to submit a special request to lock a database or enab...

CVE-2015-2760

Cross-site scripting XSS vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2758

The ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL...