CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

CVE-2016-3173: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

Huawei CloudEngine 12800 Switch Memory Leak Vulnerability

Huawei CloudEngine 12800 is a switch device from Huawei, China. The Huawei CloudEngine 12800 switch memory disclosure vulnerability. Due to a lack of validation of certain fields in a message, the LDP Label Distribution Protocol processing module does not free memory requested to process the...

Change "User Name" text at login page

In order to avoid confusion for users we need to change the text on the StoreFront webpage from "User Name" to "eID" in order to match nomenclature in use at our university...

Memory leak vulnerability in several Huawei products

Huawei AR3200 is a Huawei router device, and S12700, S5300, S5700, S6300, S6700, S7700, S9300, S9700 are Huawei switch devices. A memory disclosure vulnerability exists in multiple Huawei products. Due to the device's Multiprotocol Label Switching MPLS message processing module repeatedly...

Denial of Service Vulnerability in Multiple Huawei Products (CNVD-2016-11388)

Huawei S9700 and others are S-series switches from Huawei China. A denial of service vulnerability exists in multiple Huawei products, which originates from a program failing to properly validate Multiprotocol Label Switching MPLS messages. A remote attacker could cause a denial of service by...

DEBIAN-CVE-2016-5427

PowerDNS aka pdns Authoritative Server before 3.4.10 does not properly handle a . dot inside labels, which allows remote attackers to cause a denial of service backend CPU consumption via a crafted DNS query...

Threat Outbreak Alert RuleID24489: Email Messages Distributing Malicious Software on September 26, 2016

Medium Alert ID: 48861 First Published: 2016 September 12 19:18 GMT Last Updated: 2016 September 27 13:47 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat...

Threat Outbreak Alert RuleID24803: Email Messages Distributing Malicious Software on September 11, 2016

Medium Alert ID: 48831 First Published: 2016 September 12 13:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24803 may contain the following files: Name ...

Threat Outbreak Alert RuleID24847: Email Messages Distributing Malicious Software on September 7, 2016

Medium Alert ID: 48797 First Published: 2016 September 7 13:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24847 may contain the following files: Name |...

GitLab: Boards leak private label names and desciptions

Vulnerability details In anticipation of today's release, I took a look at the new boards feature - which, unrelated to this report, is awesome! There turns out to be an IDOR vulnerability when creating a list based on a label. An attacker can create a list with a label ID that belongs to a priva...

PT-2016-6825 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.12.2 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the label parameter. This is related to the app/helpers/form helper.rb file in Foreman, which is use...

CVE-2016-6319: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in app/helpers/formhelper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter...

The vulnerability of the Cisco IOS operating system, which allows a malicious actor to trigger a service failure

Cisco IOS software contains a vulnerability that, when exploited, can cause the error ID CSCtj30155 and trigger a router reboot by sending specially crafted ICMPv6 packets via Multiprotocol Label Switching MPLS...

DEBIAN-CVE-2016-2074

Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command...

Huawei AR3200 MPLS Memory Disclosure Vulnerability

The Huawei AR3200 is an AR3200 series enterprise router from Huawei, China. A memory leak vulnerability exists in the processing of MPLS packets in the Huawei AR3200, which can be exploited by a remote attacker to send a large number of Multiprotocol Label Switching MPLS packets to crash the syst...

CVE-2016-5368

Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service memory consumption via a large number of crafted Multiprotocol Label Switching MPLS packets...

The "Restrict to articles with labels" option doesn't restrict the customer portal from suggesting KB's other than those with the nominated Label

h3. Summary Currently we have the "Restrict to articles with labels", where you can specify the label for a request. When a customer is filling the summary for a request, SD will search the knowledge base for similar content from confluence pages with that label. However, the customer portal sear...

Cisco NX-OS Software Label Distribution Protocol Message Vulnerability (Cisco-SA-20140123-CVE-2014-0677)

A vulnerability in the Label Distribution Protocol LDP message processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an affected device to stop accepting valid LDP sessions during a 60-second period. Copyright C 2016 Greenbone Networks GmbH Some text...

Important: Red Hat Security Advisory: ImageMagick security update

An update for ImageMagick is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...