Downloads Resources over HTTP

Overview Affected versions of nodeschnaps insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution ...

Downloads Resources over HTTP

Overview Affected versions of unicode-json insecurely downloads resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on...

Downloads Resources over HTTP

Overview Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

Downloads Resources over HTTP

Overview Affected versions of ibmdb insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the...

Downloads Resources over HTTP

Overview Affected versions of unicode insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the...

Kibana 4.6.2 released with a security fix for an XSS vulnerability

Today, we've published Kibana 4.6.2 as a security release with a fix for an XSS vulnerability with field formatters. Any users of Kibana versions 4.3 to 4.6 are encouraged to update to 4.6.2 immediately. Kibana version 4.1.11 is not affected. Kibana installs on Elastic Cloud have been updated...

Wordpress simple-image-manipulator plugin remote file download vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language. simple-image-manipulator is one of the image manipulator plugin. A remote file download vulnerability exists in Wordpress simple-image-manipulator plugin v1.0, which can be exploited by...

Apple starts downloading MacOS Sierra automatically to your MacBook — Here's How to Stop It

Are you experiencing slow Internet speed on your MacBook today? — It's not just you! Here's Why: Following in Microsoft's footsteps, Apple has started "pre-downloading" the latest version of its desktop operating system, macOS 10.12 Sierra, in the background, if you are still running OS X El...

JVN#11288252: Cybozu Office vulnerable to Reflected File Download (RFD)

Cybozu Office contains a Reflected File Download RFD vulnerability. Impact If a user accesess a malicious page while logged in, unintended files may be downloaded. Solution Update the Software Update to the latest version according to the information provided by the developer. Products Affected...

September 29, 2016 — KB3194496 (OS Builds 14393.222)

None None...

DEBIAN-CVE-2016-7098

Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open...

CVE-2016-6412

The Cisco Application-hosting Framework CAF component in Cisco IOS 15.61T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers, aka Bug ID CSCuz84773...

Code injection

The Cisco Application-hosting Framework CAF component in Cisco IOS 15.61T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers, aka Bug ID CSCuz84773...

CVE-2016-6412

The Cisco Application-hosting Framework CAF component in Cisco IOS 15.61T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers, aka Bug ID CSCuz84773...

PT-2016-3442 · Postgresql · Postgresql

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 9.3.15 PostgreSQL versions 9.4.x prior to 9.4.10 PostgreSQL versions 9.5.x prior to 9.5.5 Description: The issue is related to the interactive installer in PostgreSQL, which might allow remote attackers to execute...

Cisco Web Security Appliance HTTP Load Denial of Service Vulnerability

A vulnerability in HTTP request forwarding with Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to link saturation. The vulnerability is due to how HTTP data ranges are downloaded from the destinatio...

Concrete CMS: Content Spoofing possible in concrete5.org

An attacker can include any arbitrary text using specially crafted concrete5 url. This is done using character /%0d%0a. Input https://www.concrete5.org/%0d%0ahas%20moved%20to%20www.evil.com.Please%20visit%20evil.com%20Present%20resource Output The requested URL / has moved to www.evil.com.Please...

Safari < 9.1 Multiple Vulnerabilities

Binary data 9396.prm...

Google Shares Android Nougat, Safe Browsing Security Enhancements

Google this week shared with developers security enhancements it has added to the new Nougat version of Android and additional security features for webmasters via Safe Browsing to help pinpoint harmful content on websites. Under the banner of its nine-year-long Safe Browsing initiative, Google...

SOL32049025 - BIND vulnerability CVE-2016-6170

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...