DEBIAN-CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

UBUNTU-CVE-2016-9139

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment...

CVE-2016-5372

Cross-site request forgery CSRF vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors...

UBUNTU-CVE-2016-2517

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service prevent subsequent authentication by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE:...

Mis-configuration of Apache Velocity template engine used to send emails in GigaCC OFFICE

Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains mis-configuration of Apache Velocity template engine which is used to send emails. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and...

NETGEAR Multiple Product Catalog Traversal Vulnerability

NETGEAR is an American Netgear company, a manufacturer of computer networking equipment and other computer hardware. NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, SRX5308 devices with firmware versions prior to 4.3.3-8 have a directory traversal vulnerability in scgi-bin/platform.cgi that could allow a...

CVE-2016-9217

A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.30ZN0.99...

SQL Injection Vulnerability in Mito MetInfo V5.3 Backend

MetInfo is an enterprise website management system with PHP Mysql architecture. A SQL injection vulnerability exists in the backend of MetInfo V5.3. Due to the lack of filtering of the class1 parameter, which allows attackers to exploit the vulnerability to obtain sensitive database information...

CVE-2016-0909

EMC Avamar Data Store ADS and Avamar Virtual Edition AVE versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users...

Juniper Junos Denial of Service Vulnerability (CNVD-2016-10603)

Juniper Junos OS is a Juniper Networks network operating system designed for the company's hardware systems. The OS provides a secure programming interface and the Junos SDK. A denial of service vulnerability exists in the 'udp6ctlinput' function in Juniper Junos version 9.3, which can be exploit...

CVE-2016-5525

Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.3 allows local users to affect integrity via vectors related to Cluster check files...

Oracle Sun Systems Products Suite Solaris Component Local Denial of Service Vulnerability

Oracle Solaris is a set of Unix-like operating systems from Oracle. A local denial of service vulnerability exists in the Filesystem subcomponent of the Oracle Solaris component of the Oracle Sun Systems Products Suite, versions 10 and 11.3. An attacker could exploit this vulnerability to cause a...

Installer of Evernote for Windows may insecurely load Dynamic Link Libraries

Overview The installer of Evernote for Windows contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Takashi Yoshikawa of Mitsui Bussan Secure Directions reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Informati...

CVE-2016-5927

IBM Tivoli Storage Manager for Space Management aka Spectrum Protect for Space Management 6.3.x before 6.3.2.6, 6.4.x before 6.4.3.3, and 7.1.x before 7.1.6, when certain dsmsetpw tracing is configured, allows local users to discover an encrypted password by reading application-trace output...

Malware Information Sharing Platform Cross-Site Scripting Vulnerability

The Malware Information Sharing Platform MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and analyzing cybersecurity events and malware. A cross-site scripting vulnerability exists in the template-creation function of the add.ctp,...

Red Hat JBoss BPMS Information Disclosure Vulnerability

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. A remote information disclosure vulnerability exists in Red Hat...

Apple iOS WebKit Memory Corruption Vulnerability

iOS is an operating system developed by Apple for mobile devices, and supported devices include iPhone, iPod touch, iPad, and Apple TV. A memory corruption vulnerability exists in Apple iOS versions WebKit prior to 9.3.5, which can be exploited by an attacker to execute arbitrary code or cause a...

Apple iOS kernel suffers from information disclosure vulnerability

iOS is an operating system developed by Apple for mobile devices, and supported devices include iPhone, iPod touch, iPad, and Apple TV. An information disclosure vulnerability exists in the kernel of Apple iOS versions prior to 9.3.5, which can be exploited by an attacker to gain access to...

Drupal hosting module access rights bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. hosting is one of the core modules of the Aegir hosting system. An access privilege bypass vulnerability exists in Drupal hosting module versions 7.x-3.x prior to 7.x-3.7. An attacker...

DEBIAN-CVE-2016-6214

gdtga.c in the GD Graphics Library aka libgd before 2.2.3 allows remote attackers to cause a denial of service out-of-bounds read via a crafted TGA file...