CVE-2017-5592

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity 0.4.7 - 0.5.0...

U.S. Dept Of Defense: Bypass file access control vulnerability on a DoD website

A DoD website was configured in a manner that allowed a remote user to bypass a file access control. This vulnerability could have allowed the user to view potentially sensitive system files. @generaleg able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @generale...

CVE-2016-8918

IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials...

CVE-2016-8918

IBM Integration Bus (V10, and later) under non-default configurations could allow a remote attacker to authenticate without valid credentials, effectively bypassing authentication. The root cause is an authentication vulnerability in non-default configurations, reported as CVE-2016-8918. A fix is...

Mapserver Buffer Overflow Vulnerability

MapServer is an open source web mapping software. A buffer overflow vulnerability exists in Mapserver that could allow a remote user to crash the service or possibly execute arbitrary code...

Debian DSA-3766-1 : mapserver - security update

It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DLA-790-1 : mapserver security update

It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version...

[SECURITY] [DSA 3766-1] mapserver security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3766-1 [email protected] https://www.debian.org/security/ Sebastien Delafond January 19, 2017 https://www.debian.org/security/faq -...

CVE-2016-3414

Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 102029...

CVE-2016-6896

Directory traversal vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. dot dot in the plugin parameter to wp-admin/admin-ajax.php, as...

Deserialization of untrusted data

The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted 1 INCLUDE or 2 INCLURE tag and then accessing it with a validerxml action...

Debian: Security Advisory (DSA-3766-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: ipa security update

An update for ipa is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

UBUNTU-CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

Joomla aWeb Cart Watching System for Virtuemart 2.6.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching = 2.6.0 Date: 28-12-2016 Software Link: http://awebsupport.com/products/aweb-cartwatching-system Exploit Author: Javi Espejoqemm Contact:...

Joomla! Component aWeb Cart Watching System for Virtuemart 2.6.0 - SQL Injection

Joomla! Component aWeb Cart Watching System for Virtuemart 2.6.0 - SQL Injection Exploit Title: Sqli Blind Timebased on Joomla + Viertuemart + aweb-cartwatching-system/aweb-cartwatching = 2.6.0 Date: 28-12-2016 Software Link: http://awebsupport.com/products/aweb-cartwatching-system Exploit Author...

CVE-2016-9681

Multiple cross-site scripting XSS vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name...

OpenSSL 1.1.0a/1.1.0b - Denial of Service Exploit

Exploit for linux platform in category dos / poc Exploit Title: OpenSSL 1.1.0a & 1.1.0b Heap Overflow Remote DOS vulnerability Date: 11-12-2016 Software Link: https://www.openssl.org/source/old/1.1.0/ Exploit Author: Silverfox Contact: http://twitter.com/Silverfox Website:...

OpenSSL 1.1.0a/1.1.0b - Denial of Service

Exploit Title: OpenSSL 1.1.0a & 1.1.0b Heap Overflow Remote DOS vulnerability Date: 11-12-2016 Software Link: https://www.openssl.org/source/old/1.1.0/ Exploit Author: Silverfox Contact: http://twitter.com/Silverfox Website: https://www.silverf0x00.com/ CVE: CVE-2016-7054 Category: Denial of...