CVE-2016-0910

EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors...

CVE-2016-0910: Undefined Security Weakness

EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors...

SUSE-SU-2016:1509-1 Security update for libksba

This update for libksba fixes the following issues: - CVE-2016-4579: Out-of-bounds read in ksbaberparsetl - CVE-2016-4574: two OOB read access bugs remote DoS bsc979261 Also adding reliability fixes from v1.3.4...

UBUNTU-CVE-2016-5300

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876...

CVE-2016-5300

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876...

PT-2016-6354

Name of the Vulnerable Software and Affected Versions Expat affected versions not specified Description The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted identifiers in...

SUSE-SU-2016:1458-1 Security update for java-1_6_0-ibm

This update for java-160-ibm fixes the following issues: - Update to sr16 fp26 to fix a regression in TLS connections. bsc981087 - IBM Java 1.6.0 SR16 FP25 released bsc977646 bsc977648 bsc977650 bsc979252 CVE-2016-0376 CVE-2016-0264 CVE-2016-0363 CVE-2016-3443 CVE-2016-0687 CVE-2016-0686...

Moxa EDR-G903 Information Disclosure Vulnerability (CNVD-2016-03388)

The Moxa EDR-G903 is an all-in-one firewall/VPN security router product. A security vulnerability exists in the Moxa EDR-G903 that allows remote attackers to submit special URIs to obtain configuration file and log file information...

MGASA-2016-0182 Updated mariadb packages fix security vulnerabilities

Updated mariadb packages fix security vulnerabilities: The mariadb package has been updated to version 10.0.25. It fixes several security issues CVE-2016-0643, CVE-2016-0647, CVE-2016-0648, CVE-2016-0655, CVE-2016-0666 and other bugs. See the upstream release notes for details...

OpenStack Keystone Design Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration and Rackspace, Inc. in the U.S. OpenStack Keystone is one of the projects used for authentication, providing identity, token, directory, and policy services. A security vulnerability...

tomcat: security manager bypass via StatusManagerServlet

It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs...

GLSA-201605-02 : Chromium: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201605-02 Chromium: Multiple vulnerabilities Multiple vulnerabilities have been discovered in the Chromium web browser. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly...

Allfresco Community Edition: source code security analysis report

Several vulnerabilities were discovered in Alfresco Software 'Allfresco Community Edition' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Использование метода finalize Отсутствие верификации цифровой подписи исполняемых...

EUVD-2016-2171

Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different...

CVE-2016-2449

services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtainin...

Kallithea Elevation of Privilege Vulnerability

Kallithea, a project under the US-based Software Freedom Conservancy organization, is a free source code management system. The system supports Mercurial and Git version control systems, hosting code, managing access control, and more. Kallithea suffers from an elevation of privilege vulnerabilit...

OSEC-2016-02 Memory disclosure in mirage-net-xen

Background MirageOS is a library operating system using cooperative multitasking, which can be executed as a guest of the Xen hypervisor. Virtual devices, such as a network device, share memory between MirageOS and the hypervisor. MirageOS allocates and grants the hypervisor access to a ringbuffe...

DEBIAN-CVE-2016-4079

epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows remote attackers to cause a denial of service out-of-bounds write and application crash via a crafted packet...

CVE-2016-4079

epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows remote attackers to cause a denial of service out-of-bounds write and application crash via a crafted packet...

Plone Information Disclosure Vulnerability (CNVD-2016-02598)

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on the application server Zope. An information disclosure vulnerability exists in Plone, which can be exploited by an attacker to obtain ID information for private content...