CVE-2016-4721

CVE-2016-4721 affects Apple’s IDS - Connectivity component on iOS < 10.1 and macOS

CVE-2016-4721: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "IDS - Connectivity" component, which allows man-in-the-middle attackers to spoof calls via a "switch caller" notification...

PT-2017-1312

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.1 macOS versions prior to 10.12.1 Description The issue involves the IDS - Connectivity component, which allows man-in-the-middle attackers to spoof calls via a switch caller notification. This is related to errors in...

DEBIAN-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php...

UBUNTU-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php...

SQL Injection Vulnerability in Ocean CMS zyapi.php Page

Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the Ocean CMS zyapi.php page. The lack of filtering of the '$ids' parameter allows attackers to exploit the vulnerability to obtain sensitive information about the database...

CVE-2017-3801

Cisco UCS Director privilege escalation (CVE-2017-3801) affects the web-based GUI in Cisco UCS Director 6.0.0.0 and 6.0.0.1. The root cause is improper RBAC after enabling the Developer Menu, enabling an authenticated, local user with an end-user profile to add catalogs containing arbitrary workf...

Information disclosure

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2017-3807

CVE-2017-3807 is a heap overflow vulnerability in Cisco ASA Software’s Clientless SSL VPN CIFS code, affecting ASA 5500 Series, 5500-X Series, ASAv, and related platforms (releases 9.0–9.6). The root cause is insufficient validation of user-supplied input, exploitable via a crafted URL over IPv4/...

CVE-2017-3813

A vulnerability in the Start Before Logon SBL module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the acce...

CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...

Design/Logic Flaw

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...

CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...

Path Injection Via Minion Ids

Salt is vulnerable to path injection attacks via minion ids. Salt masters do not properly validate the id of a connecting minion. This can lead to an attacker uploading files to the master in arbitrary locations. In particular, this can be used to bypass the manual validation of new unknown...

PT-2017-10018

Name of the Vulnerable Software and Affected Versions F5 BIG-IP affected versions not specified Description A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may...

CVE-2016-9244: Exposure of Sensitive Information to an Unauthorized Actor

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...

[SECURITY] [DSA 3782-1] openjdk-7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3782-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 08, 2017 https://www.debian.org/security/faq -...

PYSEC-2017-64

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

UBUNTU-CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

Design/Logic Flaw

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit MCU Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. The vulnerability is due to improper size validation when...