PHP < 5.5.38, 5.6.x < 5.6.24, 7.0.x < 7.0.9 Multiple Vulnerabilities (Jul 2016) - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PHP locale_accept_from_http Denial of Service Vulnerability

PHP is a widely used general-purpose scripting language that is particularly well suited for web development and can be embedded in HTML. The ext/intl/locale/localemethods.c/localeacceptfromhttp function in versions prior to PHP 5.5.38, 5.6.x prior to 5.6.24, and 7.x prior to 7.0.9 does not...

CVE-2016-6294

The localeacceptfromhttp function in ext/intl/locale/localemethods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU ulocacceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service out-of-bounds read or...

PHP gettext 1.0.12 - (gettext.php) Unauthenticated Code Execution

Exploit for php platform in category web applications CVE-2016-6175 gettext.php | @kmkzsecurity Project Homepage: https://launchpad.net/php-gettext/ Download: https://launchpad.net/php-gettext/trunk/1.0.12/+download/php-gettext-1.0.12.tar.gz Version: 1.0.12 latest release Tested on: Linux Debian,...

PT-2016-3391

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.38 PHP versions 5.6.x prior to 5.6.24 PHP versions 7.x prior to 7.0.9 Description The issue is related to the locale accept from http function in PHP, which does not properly restrict calls to the ICU uloc...

Internet Bug Bounty: locale_accept_from_http out-of-bounds access

Bug https://bugs.php.net/bug.php?id=72533 Reported to PHP 2016-07-03 04:03 UTC Patch: 2016-07-19 08:55 UTC http://git.php.net/?p=php-src.git;a=commit;h=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4 Fixed for PHP 5.5 security only mode, PHP 5.6, PHP 7.0 http://php.net/ChangeLog-5.php...

UBUNTU-CVE-2016-5093

The geticuvalueinternal function in ext/intl/locale/localemethods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service out-of-bounds read or possibly have unspecified other...

Apache Struts XSS

The vulnerability of the Apache Struts software platform exists due to the lack of text validation in the Locale object, which is constructed using I18NInterceptor. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...

BlackBerry Enterprise Service Cross-Site Scripting Vulnerability (CNVD-2016-02632)

BlackBerry Enterprise Service BES is a next-generation mobile device management platform from BlackBerry Canada. A cross-site scripting vulnerability exists in the index.jsp/loggedOut.jsp file in BES version 12.3.1, which can be exploited by a remote attacker to affect confidentiality, integrity...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Locale or 2 FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm...

CVE-2015-8606

Multiple cross-site scripting XSS vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Locale or 2 FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm...

CVE-2015-8606: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Locale or 2 FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm...

PT-2016-3932

Name of the Vulnerable Software and Affected Versions SilverStripe CMS & Framework versions prior to 3.1.16 SilverStripe CMS & Framework versions 3.2.x prior to 3.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the Locale or...

Cross site scripting

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...

CVE-2016-2162

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...

CVE-2016-2162

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...

CVE-2016-2162: Improper Neutralization of Input During Web Page Generation

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors involving language display...

PT-2016-1649

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x through 2.3.25 Description The issue arises from the lack of text sanitization in the Locale object constructed by I18NInterceptor, potentially allowing remote attackers to conduct cross-site scripting XSS attacks vi...

March 8, 2016, update for Visio 2016 (KB3114844)

None None...

Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)

This updates addresses a critical security vulnerability in the DNS resolver related to AFUNSPEC queries with getaddrinfo CVE-2015-7547. It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves malloc scalability for applications which start and terminate many threads. The...