CVE-2015-8861

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

CVE-2015-4626

CVE-2015-4626 affects B.A.S C2Box; versions before 4.0.0 (r19171) rely on client-side validation, enabling a remote attacker to bypass validation and corrupt business logic via negative overdraft input. The vulnerability stems from unvalidated client input allowing server-side impact. >=4.0.0 ...

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data...

CVE-2015-8971

The CVE-2015-8971 issue affects Terminology (terminal emulator) version 0.7.0, where incorrect sanitising of character escape sequences allows an attacker to execute arbitrary commands by crafting escape sequences that modify the window title and are written to the terminal. Root cause: failure t...

cURL: Multiple vulnerabilities

Background cURL is a tool and libcurl is a library for transferring data with URL syntax. Description Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers and bug reports referenced for details. Impact Remote attackers could conduct a Man-in-the-Middle attack t...

CVE-2016-3412

CVE-2016-3412 refers to multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration prior to version 8.7.0. The description indicates remote attackers could inject arbitrary web script or HTML through unspecified attack vectors (bugs 103997, 104413, 104414, 104777, 104791). The co...

CVE-2016-4019

Technical details about CVE-2016-4019 are not publicly available in the provided documents; no affected components, root cause, or fixes are specified. Monitor for updates from Zimbra advisories and related references.

CVE-2016-7904

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2016-7433

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."...

CVE-2016-8882

CVE-2016-8882 affects JasPer’s libjasper: the jpc_dec_tilefini function in jpc_dec.c is vulnerable in JasPer releases before 1.900.8, allowing a crafted file to trigger a NULL pointer dereference and cause a denial of service. This is documented across multiple advisories (EulerOS, Mageia, Huawei...

Debian DLA-767-1 : curl security update

It was discovered that libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the...

[ASA-201701-11] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201701-11 ========================================== Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-117 Summary ======= The packag...

[ASA-201701-8] libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201701-8 ========================================= Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-114 Summary ======= The package...

[ASA-201701-9] lib32-curl: multiple issues

Arch Linux Security Advisory ASA-201701-9 ========================================= Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-115 Summary ======= The package lib32-curl...

[ASA-201701-10] lib32-libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201701-10 ========================================== Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-116 Summary ======= The packag...

[SECURITY] [DLA 767-1] curl security update

Package : curl Version : 7.26.0-1+wheezy18 CVE ID : CVE-2016-9586 Debian Bug : 848958 It was discovered that libcurls implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The fla...

CVE-2016-9586

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks...

printf floating point buffer overflow

libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary check...

CURL-CVE-2016-9586 printf floating point buffer overflow

libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary check...

CVE-2016-9586

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks...