UBUNTU-CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

CVE-2015-8346

CVE-2015-8346 affects Redmine, where rendering the timelog form in versions prior to 2.6.8 (and 3.0.x prior to 3.0.6, and 3.1.x prior to 3.1.2) allows remote attackers to obtain sensitive information about subjects of issues. The issue is a information disclosure through the time-logging form. Re...

CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

CVE-2015-8346

app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form...

ISC BIND buffer.c REQUIRE Assertion Failure Denial of Service (CVE-2015-8705)

A denial-of-service vulnerability has been reported in BIND DNS package bind9. The vulnerability is due to improper conversion of OPT resource records ECS options to text format. A remote, unauthenticated attacker could exploit this vulnerability against Recursive or Authoritative DNS servers tha...

Understanding and Configuring EPA Verbose Logging on Citrix Gateway

CLI Configuration Run the following command on NetScaler for PreAuth and PostAuth EPA logging: set vpn param –clientSecurityLog ON Note : For PreAuth and PostAuth logging, the vpn param MUST be used. If the clientSecurityLog is modified in a SessionAction whose Session Policy has a ClientSecurity...

CVE-2016-2074

Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2016-0038)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices 1245969 - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317816 - SSH2MSGDISCONNECT for user initiate...

CVE-2015-8152

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

CVE-2015-8152

Cross-site request forgery CSRF vulnerability in Symantec Endpoint Protection Manager SEPM 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script...

Centreon Web Useralias Command Execution

Centreon Web Interface use exploit/linux/http/centreon/useraliasexec msf undefineduseraliasexec show actions ...actions... msf undefineduseraliasexec set ACTION msf undefineduseraliasexec show options ...show and set options... msf undefineduseraliasexec run This module requires Metasploit:...

SUSE-SU-2016:0541-1 Security update for dhcp

This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally bsc961305 The following bugs were fixed: - bsc936923: Improper...

SUSE-SU-2016:0540-1 Security update for dhcp

This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally bsc961305 The following bugs were fixed: - bsc936923: Improper...

Core FTP Server 1.2 - Buffer Overflow (PoC)

Exploit for windows platform in category local exploits -- coding: utf-8 -- Exploit Title : Core FTP Server v1.2 - BufferOverflow POC Date: 2016-02-22 Author: INSECT.B Facebook : https://www.facebook.com/B.INSECT00 GitHub : binsect00 Blog : http://binsect00.tistory.com Vendor Homepage :...

Converting iRules to NetScaler Policies - HTTP Request Cloning

The iRules to NetScaler conversion guides take you through the process of converting your F5 iRules into policies on NetScaler. If you have been using iRules and would like to create the same functionality on NetScaler these guides simplify the process and gets you up and running faster. Use Case...

SUSE-SU-2016:0481-1 Security update for dhcp

This update for dhcp fixes the following issues: - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally bsc961305 The following bugs were fixed: - bsc936923: Improper...

OracleVM 2.2 : xen (OVMSA-2016-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-125: Limit XENDOMCTLmemorymapping hypercall to only process up to 64 GFNs or less Jan Beulich 20732412 CVE-2015-2752 - XSA-126: xen: limit guest control of PCI command register Jan Beulich 2073939...

Greater Visibility Through PowerShell Logging

UPDATE Feb. 29: This post has been updated with new configuration recommendations due to the Feb. 24 rerelease of PowerShell 5, and now includes a link to a parsing script that users may find valuable. Introduction Mandiant is continuously investigating attacks that leverage PowerShell throughout...

ATutor 2.2 - Multiple Cross-Site Scripting Vulnerabilities

ATutor 2.2 - Multiple Cross-Site Scripting Vulnerabilities Security Advisory - Curesec Research Team 1. Introduction Affected Product: Atutor 2.2 Fixed in: partly in ATutor 2.2.1-RC1, complete in 2.2.1 Fixed Version Link: http://www.atutor.ca/atutor/download.php Vendor Website:...