CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

Code injection

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CR0.TS and CR0.EM not always honored for x86 HVM guests

ISSUE DESCRIPTION Instructions touching FPU, MMX, or XMM registers are required to raise a Device Not Available Exception NM when either CR0.EM or CR0.TS are set. Their AVX or AVX-512 extensions would consider only CR0.TS. While during normal operation this is ensured by the hardware, if a guest...

CVE-2016-7571

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

Cross site scripting

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

CVE-2016-7571

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

CVE-2016-7571

Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...

CVE-2016-7571

CVE-2016-7571 is a Drupal XSS vulnerability affecting Drupal 8.x before 8.1.10. The issue allows remote attackers to inject arbitrary script or HTML via vectors related to handling HTTP exception messages. Documents corroborate the vulnerability under multiple sources (NVD entry, GHSA advisory, N...

CVE-2016-7571

Removed by vendor...

Error in handleInterruptedCoalesceLeaf when trying to scan the Storage on XenServer

Error in XenCenter - SR failed to complete the operation Error in /var/log/SMlog -25840 2012-12-14 10:52:35.402274 lock: released /var/lock/sm/lvm-579fdc35-f120-398e-397e-b12179c9531c/83b6fcfd-e9ed-432b-b662-d8d28f9ccca525840 2012-12-14 10:52:35.402380 lock: closed...

OpenSSL Missing CRL sanity check Vulnerability - Linux

OpenSSL is prone to a Denial of Service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

Vulnerability in OpenSSL - Missing CRL sanity check

This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016. A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0 but was omitted from OpenSSL 1.0.2i. As a result any attempt to use CRLs in OpenSSL 1.0.2i will crash with a null pointer exception. Found by Bruce...

OpenSSL Missing CRL sanity check Vulnerability - Windows

OpenSSL is prone to a Denial of Service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

IBM WebSphere Application Server Liberty Information Disclosure Vulnerability

IBM WebSphere Application Server is an application server product developed and distributed by IBM in the United States, which is a platform for Java EE and Web services applications. IBM WebSphere Application Server The program fails to properly handle exceptions when the default error page does...

Ali wangwang 2010 remote code execution vulnerability

漏洞复现 阿里旺旺2010版本的ImageMan.dll动态链接库中，有一个COM接口负责处理图片信息，其中有一个函数AutoPic存在漏洞，当在html中加载这个COM接口，并传入特殊字符串时，会由于对字符串长度没有进行检查，在拷贝时读取到不可用地址，从而导致程序进入SEH异常处理，通过超长payload可以覆盖SEH指针从而达到eip可控的效果，下面对此漏洞进行详细分析。 首先安装阿里旺旺2010，之后用IE打开，发现IE崩溃，通过附加windbg，可以到达漏洞崩溃位置。 a5c.628: Access violation - code c0000005 first chance...

Paragon Initiative Enterprises: Not clearing hex-decoded variable after usage in Authentication

All the sensitive information variables are zeroed from memory, expect the hex2bin value of "validator". https://github.com/paragonie/airship/blob/8f04f071c414c3893cf66311839d20a343af1237/src/Engine/Security/Authentication.phpL223-L236 $stored = \Sodium\hex2bin$record$f'validator';...

Could not sign CSR Caused by: java.net.SocketTimeoutException: connect timed out

After configuring Client Certificate Authentication for XMS but you do not see a Client Certificate Request on the Issuing Server 2016-06-27T13:01:11.409+0000 | | ERROR | http-nio-10080-exec-1 | EWSession | Exception on certificate issuer com.zenprise.zdm.pki.spi.IssuingServiceException: Could no...

Could not sign CSR Caused by: java.io.IOException: Could not obtain certificate (template=XenmobileTest). Reason: The format of the specified domain name is invalid. 0x800704bc (WIN32: 1212)

After configuring Client Certificate Authentication for XMS but you do not see an issued certificate on the Issuing Server 2016-08-18T12:49:32.19+0200 | | ERROR | http-nio-10443-exec-8 | EWSession | Exception on certificate issuer com.zenprise.zdm.pki.spi.IssuingServiceException: Could not sign C...

Internet Bug Bounty: msilib.OpenDatabase Type Confusion

I have reported a vulnerability in Python that is now fixed. My patch was accepted with minor changes. --- http://bugs.python.org/issue24594 The msilib.OpenDatabase method suffers from a type confusion vulnerability caused by the behavior of MsiOpenDatabase, the underlying win32 function utilized...

CVE-XX-XX:“an Atom of the truncated Hu”the Windows kernel to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

! Author: PlayBoy23333 Royalties of: 500RMB（not taking you to the contributor!） Submission methods: send an email to linwei3 6 0. cn, or visit the web version of the online submission aintroduction A few days ago the Internet fooling around when found Rookitsmm on Github to share a mention the...