Fedora 22 : php-pecl-http-2.5.6-1.fc22 (2016-bb7bdd7063)

Version 2.5.6 Fix php-bug php71719: Buffer overflow in HTTP url parsing functions Mike, rc0r Fix gh-issue 28: Possible NULL pointer dereference in phphttpurlmod rc0r Fix gh-issue 22: Fix PHP5 config.w32 Jan Ehrhardt - Fix gh-issue 20: setSslOptions notice with curl 7.43 Mike, Vitaliy Demidov Note...

Apache ActiveMQ Web Console Missing X-Frame-Options Clickjacking

The version of Apache ActiveMQ running on the remote host is affected by a clickjacking vulnerability in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attacker can exploit this to trick a user into executing administrative tasks. No...

Gratipay: Vulnerable to clickjacking

Reproduction steps: 1.Open URL :https://grtp.co/ 2.put the url in the below code of iframe Clickjacking GRTP Website is vulnerable to clickjacking! 3.Observe that site is getting displayed in Iframe Impact: By using Clickjacking technique, an attacker hijack's click's meant for one page and route...

New Relic: newrelic.com vulnerable to clickjacking !

Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...

Debian DSA-3517-1 : exim4 - security update

A local root privilege escalation vulnerability was found in Exim, Debian's default mail transfer agent, in configurations using the'perlstartup' option Only Exim via exim4-daemon-heavy enables Perl support. To address the vulnerability, updated Exim versions clean the complete execution...

Apache ActiveMQ Web Console Single Click Hijacking Vulnerability

Apache ActiveMQ is a popular messaging and integration model provider . A security vulnerability exists in Apache ActiveMQ 5.0.0 - 5.13.1 due to an unset X-Frame-Options header for HTTP responses in the Web Management Console. This allows attackers to perform unauthorized operations in the consol...

[SECURITY] [DSA 3517-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3517-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 14, 2016 https://www.debian.org/security/faq -...

Testing TLS/SSL encryption: testssl.sh

testssl.sh is a free command line tool which checks a server’s service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws. It’s designed to provide clear output in any case. Testing TLS/SSL encryption: testssl.sh Key features Clear output: you can tell...

LeaseWeb: Found clickjacking vulnerability

Hello Security, Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking contro...

Gratipay: X-Content-Type Header Missing For aspen.io

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared...

Core FTP Server 1.2 - Buffer Overflow (PoC)

Exploit for windows platform in category local exploits -- coding: utf-8 -- Exploit Title : Core FTP Server v1.2 - BufferOverflow POC Date: 2016-02-22 Author: INSECT.B Facebook : https://www.facebook.com/B.INSECT00 GitHub : binsect00 Blog : http://binsect00.tistory.com Vendor Homepage :...

Security Advisory 0017

Security Advisory 0017 PDF Date: October 31st, 2017 Version: 1.6 Revision | Date | Changes ---|---|--- 1.0 | February 16th, 2016 | Initial release 1.1 | February 19th, 2016 | Updates include assessment and mitigation 1.2 | February 25th, 2016 | Updates include options for mitigation and protectio...

Fixed in Apache Tomcat 6.0.45

Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...

PT-2016-3305

Name of the Vulnerable Software and Affected Versions ISC BIND 9.x versions 9.9.9 through 9.9.9-P3 ISC BIND 9.x versions 9.10.x through 9.10.4-P3 ISC BIND 9.x versions 9.11.x through 9.11.0 Description The issue is related to errors in data processing, which can be exploited by a remote attacker ...

openSUSE Security Update : MySQL (openSUSE-2016-165)

This update to MySQL 5.6.28 fixes the following issues bsc962779 : - CVE-2015-7744: Lack of verification against faults associated with the Chinese Remainder Theorem CRT process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote...

CVE-2016-1882

FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service kernel crash via vectors related to creating a TCP connection with the TCPMD5SIG and TCPNOOPT socket options...

CURL-CVE-2016-0754 remote filename path traversal in curl tool for Windows

curl does not sanitize colons in a remote filename that is used as the local filename. This may lead to a vulnerability on systems where the colon is a special path character. Currently Windows is the only OS where this vulnerability applies. curl offers command line options --remote-name also...

The vulnerability of the MySQL database management system allows a hacker to cause a service failure.

The vulnerability of the Server sub-component of the MySQL database management system’s options involves code errors. Exploiting this vulnerability can allow a malicious actor to cause the operating system to become unresponsive, or in rare cases, to cause an emergency shutdown through network...

ISC BIND 9.3.0 < 9.9.8-P3 / 9.9.x-Sx < 9.9.8-S4 / 9.10.x < 9.10.3-P3 Multiple DoS

According to its self-reported version number, the installation of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper handling of certain string formatting options. An authenticated,...

Oracle MySQL 5.7.x < 5.7.10 Multiple Vulnerabilities (January 2016 CPU)

The version of Oracle MySQL installed on the remote host is 5.7.x prior to 5.7.10. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Client subcomponent. A local attacker can exploit this to execute arbitrary code. CVE-2016-0546 - An unspecified fla...