SAP NetWeaver AS JAVA - 'BC-BMT-BPM-DSK' XML external entity injection vulnerability

1 It is possible, that an attacker can perform a DoS attack for example, an XML Entity expansion attack 2 An SMB Relay attack is a type of man-in-the-middle attack where an attacker asks a victim to authenticate to a machine controlled by the attacker, then relays the credentials to the target. T...

MGASA-2016-0379 Updated nss and firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291,...

Debian DSA-3716-1 : firefox-esr - security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows and other implementation errors may lead to the execution of arbitrary code or bypass of the same-origin policy. Also, a man-in-the-middle attack in the addon update...

DSA-3716-1 firefox-esr - security update

Bulletin has no description...

Westermo Industrial Switch Hard-coded Certificate Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-028-01 Westermo Industrial Switch Hard-Coded Certificate Vulnerability that was published January 28, 2016, on the NCCIC/ICS-CERT web site. Independent researcher Neil Smith has identified a hard-coded certifica...

Shotwell is vulnerable

Shotwell is a Linux-based photo management software for the GNOME desktop environment. A security vulnerability exists in Shotwell version 0.22.0. The program fails to validate TLS and SSL certificates. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack...

Amazon Linux: Security Advisory (ALAS-2016-731)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MySQL 5.6.x < 5.6.34 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.34. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3srvr.c, sslsess.c, and t1lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An...

GLSA-201610-05 : Subversion, Serf: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201610-05 Subversion, Serf: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Subversion and Serf. Please review the CVE identifiers referenced below for details Impact : A remote attacker could possibly...

CVE-2016-7099

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...

CVE-2016-7099

CVE-2016-7099 affects Node.js TLS: tls.checkServerIdentity fails to properly validate certs with wildcards, enabling MITM via crafted X.509 certificates. The issue is fixed in upstream Node.js by updating to versions where wildcard handling is corrected (0.10.47, 0.12.16, 4.6.0, 6.7.0) and is ech...

CVE-2016-5348

CVE-2016-5348 affects the GPS component in Android, dating from 4.x up to 7.0, where a man-in-the-middle can trigger memory exhaustion and a DoS by sending a large xtra.bin/xtra2.bin from spoofed gpsonextra.net or izatcloud.net hosts. Root cause is malformed/overlarge GPS data files processed by ...

Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3092-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3092-1 advisory. Stefan Metzmacher discovered that Samba incorrectly handled certain flags in SMB2/3 client connections. A remote attacker could use this issue to...

Ubuntu: Security Advisory (USN-3092-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-4763

CVE-2016-4763 affects WKWebView in WebKit across Apple platforms (iOS before 10, Safari before 10) and iTunes before 12.5.1 on Windows. Root cause: certificate validation failure in WKWebView leads to improper verification of HTTPS X.509 certificates, enabling MITM attackers to spoof servers and ...

Cisco IOS and IOS XE Software Application-Hosting Framework HTTP Header Injection Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An HTTP header injection vulnerability exists in the Application-Hosting Framework component in Cisco IOS version 15.61T1 and IOS XE Software. When the Iox feature setting is...

CVE-2016-5284

CVE-2016-5284 affects Mozilla Firefox (before 49.0), Firefox ESR (before 45.4), and Thunderbird (

CVE-2016-4741

CVE-2016-4741 : In iOS up to version 9.x, the Assets component could be exploited by a network-positioned attacker to block software updates by abusing the lack of HTTPS when retrieving updates. The NVD entry describes an update-blocking MITM condition, and Apple’s security content for iOS 10 con...

KLA10876 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper value...

EUVD-2016-0788

The smtplib library in CPython aka Python before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block...