CVE-2016-9403

newreply.php in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check...

CVE-2016-9409

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs...

CVE-2016-9412

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy...

GitLab: Users with guest access can post notes to private merge requests, issues, and snippets

Vulnerability details A user with guest access to a group / project can post notes to private merge requests, issues, and snippets. Impact It seems it only allows an attacker to post notes to objects that the user doesn't have access to. I tried creating notes with slash commands, but unfortunate...

chromium-browser: type confusion in blink

The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly ha...

FreeBSD : FreeBSD -- ktrace kernel memory disclosure (6e04048b-6007-11e6-a6c3-14dae9d210b8)

Due to an overlooked merge to -STABLE branches, the size for page fault kernel trace entries was set incorrectly. Impact : A user who can enable kernel process tracing could end up reading the contents of kernel memory. Such memory might contain sensitive information, such as portions of the file...

Error Windows API: There is not enough space on the disk. Error number 0xE00000070

When trying to merge a vDisk, the following error is seen: The error is not seen when adding a vDisk or a new vDisk version to the store, just when merging the vDisk versions. Windows Explorer shows a sufficient amount of free space for the merge process in the vDisk store and running the...

DEBIAN-CVE-2016-3993

Off-by-one error in the imlibMergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service out-of-bounds read and application crash via crafted coordinates...

hp.com XSS vulnerability

Vulnerable URL: http://www.hp.com/sbso/solutions/real/assets/mayfieldmailmergecontroller.swf?csConfigFile=http://irc.0x539.xyz/hp.xml Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 320 VIP website status:| Yes...

GitLab: GFM renderer leaks external issue tracker URL of private project

Vulnerability details The GFM renderer has the ability to cross-link issues between projects. When this project is private and the user doesn't have access, the link isn't made. This is good. However, when the private project has an external issue tracker set up, an attacker can extract the...

Meld - Visual Diff And Merge Tool Targeted At Developers

Meld is a visual diff and merge tool targeted at developers. Meld helps you compare files, directories, and version controlled projects. It provides two- and three-way comparison of both files and directories, and has support for many popular version control systems. Meld helps you review code...

March 8, 2016, update for Project 2016 (KB3114865)

None None...

March 8, 2016, update for PowerPoint 2016 (KB3114847)

None None...

MySQL 5.5.x < 5.5.48 Multiple Vulnerabilities

The version of MySQL running on the remote host is 5.5.x prior to 5.5.48. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. CVE-2016-0640 - An unspecifie...

Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...

Fedora 21 : qemu-2.1.3-11.fc21 (2015-16368)

CVE-2015-6815: net: e1000: infinite loop issue bz 1260225 CVE-2015-6855: ide: divide by zero issue bz 1261793 CVE-2015-5278: Infinite loop in ne2000receive bz 1263284 CVE-2015-5279: Heap overflow vulnerability in ne2000receive bz 1263287 Make block copy more stable bz 1264416 Fix hang at start of...

ZAP 2.4.2 - Penetration Testing Tool for Testing Web Applications

The Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testin...

Backup Copy Job Failures when using ExaGrid de-duplicating storage

Challenge Backup Copy Jobs can fail when writing to ExaGrid storage. Cause De-duplicating storage can incorrectly update existing backup files during Veeam "merge" operation. Solution Make sure your ExaGrid Storage firmware version is 4.7.0 P52 or newer. For additional information please contact...

CVE-2015-3360

Cross-site scripting XSS vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...