3: s2i builds implicitly perform docker builds

A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should n...

CVE-2016-2016

Base-VxFS-50 B.05.00.01 through B.05.00.02, Base-VxFS-501 B.05.01.0 through B.05.01.03, and Base-VxFS-51 B.05.10.00 through B.05.10.02 on HPE HP-UX 11iv3 with VxFS 5.0, VxFS 5.0.1, and VxFS 5.1SP1 mishandles ACL inheritance for default:class: entries, default:other: entries, and default:user:...

chromium: multiple issues

CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding. Credit to kdot working with HP's Zero Day Initiative. - CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous. - CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han. - CVE-2016-1654: Uninitialized...

UBUNTU-CVE-2016-1028

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-1012,...

5: stored and reflected XSS vulnerabilities

Multiple cross-site scripting XSS flaws were found in the way HTTP GET parameter data was handled in Red Hat Satellite. A user able to provide malicious links to a Satellite user could use these flaws to perform XSS attacks against other Satellite users...

5: multiple stored XSS vulnerabilities

Multiple cross-site scripting XSS flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users...

BugCrowd CSV Injection

Description: A vulnerability in the file upload feature allows attackers to send malicious csv files. By using the Microsoft Excel DDE function an attacker can launch arbritary commands on the victims system. Many companies don't allow xslx or docx files to be uploaded by security testers, becaus...

CVE-2016-1979

Use-after-free vulnerability in the PK11ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services NSS before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data...

CVE-2016-1979

Use-after-free vulnerability in the PK11ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services NSS before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data...

Roundup Information Disclosure Vulnerability

Roundup is a command line, web and email issue tracking system. The system provides bug tracking, customer help desk and issue management. An information disclosure vulnerability exists in Roundup. An attacker could exploit this vulnerability to obtain sensitive information about other users...

Redmine Cross-Site Scripting Vulnerability

Redmine is a set of open source Web-based project management and defect tracking tools . A cross-site scripting vulnerability exists in Redmine. An attacker can exploit this vulnerability to execute arbitrary script code, steal cookie-based authentication and launch other attacks...

Multiple Vulnerabilities in OpenStack Object Storage

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Object Storage a.k.a. Swift is one of these programs used to storage project for storing permanent static data. A security...

Apple iOS WebKit Security Bypass Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS WebKit that allows remote attackers to exploit a vulnerability to trigger tap events to submit synthetic clicks on other different WEB pages...

Apple iOS Arbitrary App Extension Replacement Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows enterprise apps to utilize common profile applications to replace extensions for other apps...

SolarWinds N-Able N-Central Information Disclosure Vulnerability

SolarWinds N-Able N-Central is a suite of agent-based enterprise support and management solutions from SolarWinds USA. A information disclosure vulnerability exists in SolarWinds N-Able N-Central versions prior to 9.5.1.4514, which can be exploited to obtain a plaintext domain administrator...

SQL Injection Vulnerability in Panmicro E-office /E-mobile/diaryother_page.php Parameters

Panmicro E-office is an OA product launched by Panmicro for small and medium-sized organizations. A SQL injection vulnerability exists in the Panmicro E-office /E-mobile/diaryotherpage.php parameter, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Panmicro E-office /E-mobile/flow/flowtype_other.php Parameter

Panmicro E-office is an OA product launched by Panmicro for small and medium-sized organizations. A SQL injection vulnerability exists in the Panmicro E-office /E-mobile/flow/flowtypeother.php parameter, which can be exploited by an attacker to obtain sensitive information from the database...

Multiple AirTies Air product stack buffer overflow vulnerability

Airties Air 6372 and others are wireless modem products from Airties Turkey. Multiple AirTies Air products contain a cgi-bin/login that fails to properly handle extra-long strings in the 'redirect' parameter, allowing remote attackers to exploit the vulnerability by submitting a special request...

Design/Logic Flaw

Use-after-free vulnerability in the ffh264freetables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references...

Lynis 2.1.0 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...