SUSE SLES11 Security Update : tar (SUSE-SU-2016:2895-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 Note that Tenable Network...

SUSE SLED12 / SLES12 Security Update : tar (SUSE-SU-2016:2896-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 - Fix Amanda integration iss...

CVE-2016-5673

UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by using a :: substring in between the IP address and port number...

Open redirect

UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by using a :: substring in between the IP address and port number...

Generate TCP/UDP Outbound Traffic On Multiple Ports

This module generates TCP or UDP traffic across a sequence of ports, and is useful for finding firewall holes and egress filtering. It only generates traffic on the port range you specify. It is up to you to run a responder or packet capture tool on a remote endpoint to determine which ports are...

Drupal Core double-encoded 'destination' parameter open redirect vulnerability

Drupal is a free and open source content management system developed in PHP. An open redirection vulnerability exists in the Drupal Core double encoding of the 'destination' parameter.The Drupal 6 'drupalgoto' function fails to correctly decode the content of $REQUEST'destination' when used,...

Open redirect via double-encoded 'destination' parameter

More info at https://www.drupal.org/SA-CORE-2016-001...

Open redirect via double-encoded 'destination' parameter

More info at https://www.drupal.org/SA-CORE-2016-001...

CVE-2016-1572

mount.ecryptfsprivate.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid...

Ubuntu: Security Advisory (USN-2879-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : rsync vulnerability (USN-2879-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2879-1 advisory. It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination...

CVE-2015-7282

ReadyNet WRT300N-DD devices with firmware 1.0.26 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port...

Samba Bypass Access Privilege Vulnerability (CNVD-2015-08520)

Samba is a set of programs that implement the SMB Server Messages Block protocol, cross-platform file sharing and print sharing services. An access privilege bypass vulnerability exists in Samba versions 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3. The vulnerability allows an...

The vulnerability of the Android operating system allows a perpetrator to bypass the identity verification process by sending a short SMS message.

The vulnerability of the checkDestination function in the Android operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass the identity verification process by sending a short SMS message using a speciall...

Kaseya Virtual System Administrator Remote Code Execution Vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms for simplifying and automating IT services. Kaseya Virtual System Administrator's json.ashx handles HTTP headers without restricting the destination file path, allowing remote attackers to submit a special request to...

Kaseya Virtual System Administrator Remote File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the uploader.aspx page, which does not properly require that users...

Unspecified Vulnerability in Red Hat PicketLink Service Provider and Identity Provider

Red Hat PicketLink is the United States Red Hat Red Hat company's set of unified identity management framework for Java applications. A security vulnerability exists in the Service Provider SP and Identity Provider IdP in Red Hat PicketLink versions prior to 2.7.0, which stems from the program's...

Cross site scripting

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...

PT-2015-6966

Name of the Vulnerable Software and Affected Versions Drupal Migrate module versions 7.x-2.x before 7.x-2.8 Description A cross-site scripting XSS issue exists, allowing user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label when the migrate ui submodu...

CVE-2015-5514: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...