[SECURITY] Fedora 24 Update: tomcat-8.0.43-1.fc24

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

[SECURITY] Fedora 25 Update: tomcat-8.0.43-1.fc25

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participator...

CVE-2017-7415

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...

Confluence 6.0.x Information Disclosure Vulnerability

The Confluence drafts diff rest resource made the current content of all blogs and pages in Confluence available without authentication. Attackers who can access the Confluence web interface of a vulnerable version can use this vulnerability to obtain the content of all blogs and pages inside...

Google Chrome URL address forgery vulnerability

Google Chrome is a popular web browser. An address forgery vulnerability exists in Google Chrome Omnibox, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing...

Palo Alto PAN-OS Cross-Site Scripting Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. Palo Alto Networks PAN-OS suffers from a cross-site scripting vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to...

Unspecified Vulnerability in Google Chrome and Chrome OS (CNVD-2017-06652)

Google Chrome is a web browser.Google Chrome OS is an open source web-based operating system. A security vulnerability exists in Google Chrome and Chrome OS that allows remote attackers to exploit the vulnerability to build malicious web pages that can be tricked into parsing by users, which can...

Apple iOS Safari Address Bar Forgery Vulnerability

Apple iOS is an operating system for Apple smart devices. An address bar forgery vulnerability exists in Apple iOS Safari, which allows attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing and can be spoofed for content...

Apple iOS webkit element handling validation vulnerability

Apple iOS is an operating system for Apple smart devices. A validation vulnerability exists in the Webkit processing element used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can be used to bypass security...

Apple iOS webkit CSP bypass vulnerability

Apple iOS is an operating system for Apple smart devices. A CSP restriction bypass vulnerability exists in Webkit used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by users, which can bypass security restrictions and perform...

Unspecified Vulnerability in Google Chrome and Chrome OS (CNVD-2017-06653)

Google Chrome is a web browser.Google Chrome OS is an open source web-based operating system. A security vulnerability exists in Google Chrome and Chrome OS that allows remote attackers to exploit the vulnerability to build malicious web pages that can be tricked into parsing by users, which can...

Apple iOS webkit sensitive memory leak vulnerability

Apple iOS is an operating system for Apple smart devices. A sensitive memory disclosure vulnerability exists in the Webkit Handling OpenGL shaders used by Apple iOS, which allows attackers to exploit the vulnerability to build malicious web pages that can be clicked on by the user, which can be...

Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability in Twitter Cards Meta

We recently found that the Twitter Cards Meta contains a cross-site request forgery CSRF/cross-site scripting XSS vulnerability on the plugin’s setting pages,/wp-admin/admin.php?page=twitter-cards-meta. The CSRF potion of the vulnerability was due to a lack of a nonce on the page and a lack of a...

Unspecified Vulnerability in Google Chrome and Chrome OS

Google Chrome is a web browser.Google Chrome OS is an open source web-based operating system. A security vulnerability exists in Google Chrome and Chrome OS that allows remote attackers to exploit the vulnerability to build malicious web pages that can be tricked into parsing by users, which can...

Apple iOS WebKit Web Inspector Denial of Service Vulnerability

Apple iOS is an operating system for Apple smart devices. A denial of service vulnerability exists in Apple iOS WebKit Web Inspector, which allows attackers to exploit the vulnerability to build malicious WEB pages that can be clicked by users, which can crash the application...

CVE-2017-5033

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline...

CVE-2017-5191

NetIQ Access Manager (NAM) versions 4.2 and 4.3 contain a cross-site scripting (XSS) vulnerability in the /NAGErrors URI. The issue arises because the Access Gateway Error page does not validate the HTTP Referer header, enabling a remote attacker to inject arbitrary web script or HTML. No exploit...

CVE-2017-5191

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

DEBIAN-CVE-2017-8064

drivers/media/usb/dvb-usb-v2/dvbusbcore.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIGVMAPSTACK option, which allows local users to cause a denial of service system crash or memory corruption or possibly have unspecified other impact by leveraging use ...

UBUNTU-CVE-2017-8068

drivers/net/usb/pegasus.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIGVMAPSTACK option, which allows local users to cause a denial of service system crash or memory corruption or possibly have unspecified other impact by leveraging use of more than one virtual pag...