wordpress plugin front-end-post-edit cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wordpress plugin front-end-post-edit, which allows an attacker to frame...

Multiple IBM Security Access Manager Product SQL Injection Vulnerabilities

IBM Security Access Manager ISAM and others are products of IBM Corporation in the U.S. ISAM is a security access manager; IBM Security Access Manager for Web is a solution that provides mobile access security through a modular software package. An SQL injection vulnerability exists in several IS...

Cisco Intercloud Fabric Database Static Credentials Vulnerability (cisco-sa-20161221-icf)

A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a reference...

Threat Outbreak Alert RuleID27010: Email Messages Distributing Malicious Software on December 22, 2016

Medium Alert ID: 52208 First Published: 2016 December 22 15:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27010 may contain the following files: Name |...

Arbitrary Command Execution Vulnerability in Knight CMS

Knight CMS Talent System is a professional talent system based on PHP+MYSQL. Knight CMS version 4.1.0 suffers from an arbitrary command execution vulnerability. Due to the Knight CMS V4.1.0 using the tp framework there is a template engine remote code execution vulnerability. Attackers can exploi...

NetsCaler: Smart Card Authentication with EULA using nfactor

We need to do Smart Card Authentication on the NetScaler virtual server NetScaler Gateway or Load balancing and also we need the users to accept the End User License Agreement EULA before they could access the backend resource...

SUSE-SU-2016:3148-1 Security update for flash-player

This update for flash-player fixes the following issues: - Security update to 24.0.0.186 bsc1015379 APSB16-39: These updates resolve use-after-free vulnerabilities that could have lead to code execution CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881,...

CVE-2016-9212

Cisco Web Security Appliance (WSA) Drop Decrypt Policy Bypass (CVE-2016-9212) is caused by incomplete HTTP header input validation in the Decrypt for End-User Notification configuration. Under HTTPS decryption, an unauthenticated remote attacker could connect to a blocked HTTPS website despite po...

UBUNTU-CVE-2016-7952

X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service infinite loop via a reply in the 1 XRecordStartOfData, 2 XRecordEndOfData, or 3 XRecordClientDied category without a client sequence and with attached data...

TR-064 vulnerabilities to the affected vendors of equipment and TR-064 Protocol security analysis-vulnerability warning-the black bar safety net

! Author: British Xiphos Research, senior security researcher Darren Martyn Over the past few weeks, the embedded device demonstrated the security situation worrisome, in the Mirai early code is public, I think some of the“smart device”botnet will quickly spread, in addition to the telnet scannin...

WordPress Symposium Plugin SQL Injection (CVE-2015-6522)

An SQL injection vulnerability exists in the WordPress Symposium Plugin. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data...

Piwigo 'search_rules.php' Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the 'search results front end' feature in Piwigo version 2.8.3. A remote...

DLA-728-1 tomcat6 - security update

Bulletin has no description...

Buffer overflow vulnerability in CFM function in multiple Huawei products

CloudEngine 5800, CloudEngine 6800, CloudEngine 7800, CloudEngine 8800, CloudEngine 12800 are Huawei switch devices. A buffer overflow vulnerability exists in the CFM Connectivity Fault Management feature in multiple Huawei products. When the device uses CFM and is configured with MEP Maintenance...

[SECURITY] [DLA-709-1] postgresql-9.1 update

Package : postgresql-9.1 Version : 9.1.24-0+deb7u1 Several bugs were discovered in PostgreSQL, a relational database server system. This update corrects various stability issues. 9.1.24 marks the end of life of the PostgreSQL 9.1 branch. No further releases will be made by the PostgreSQL Global...

DLA-709-1 postgresql-9.1 - bugfix update

Bulletin has no description...

Stored Cross-Site Scripting Vulnerability in yiqicms

Yiqicms is a marketing enterprise website system based on SEO-friendly development, using PHP+Mysql open source building system. Yiqicms front-end stored cross-site scripting vulnerabilities. As the foreground to receive msgtitle msgname failed to filter the output code , only msgcotent parameter...

The use of Python code implementing the Web application of the injection-vulnerability warning-the black bar safety net

Vulnerability overview If your Web application exists in the Python code injection vulnerability, the attacker can use your Web applications to your back-end server of the Python parser to send malicious Python code. This also means that if you can on the target server execute Python code, you ca...

Microsoft Tears off the Band-Aid with EMET

Microsoft last week extended the end-of-life expiration date to July 2018 on its exploit mitigation add-on, the Enhanced Mitigation Experience Toolkit EMET. But for some time, the once-useful tool has been well on its way out to pasture. While EMET was never meant to be anything more than stopgap...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3635)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3635 advisory. - sched: panic on corrupted stack end Jann Horn Orabug: 24971921 CVE-2016-1583 - ecryptfs: forbid opening files without mmap handler Jann Horn Orabug:...