openstack-neutron: MAC source address spoofing vulnerability

Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests...

openstack-neutron: ICMPv6 source address spoofing vulnerability

Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests...

openstack-neutron: MAC source address spoofing vulnerability

Neutron functionality includes internal firewall management between networks. Due to the relaxed nature of particular rules, it is possible for machines on the same layer 2 networks to forge non-IP traffic, such as ARP and DHCP requests...

FreeBSD : flash -- multiple vulnerabilities (a522d6ac-4aed-11e6-97ea-002590263bf5)

Adobe reports : These updates resolve a race condition vulnerability that could lead to information disclosure CVE-2016-4247. These updates resolve type confusion vulnerabilities that could lead to code execution CVE-2016-4223, CVE-2016-4224, CVE-2016-4225. These updates resolve use-after-free...

GD: Multiple vulnerabilities

Background GD is a graphic library for fast image creation. Description Multiple vulnerabilities have been discovered in GD. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause ...

nginx: Insufficient limits of CNAME resolution in resolver

It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration...

MS16-086: Cumulative security update for JScript and VBScript: July 12, 2016

Resolves a vulnerability in Windows that could allow remote code execution if a user visits a specially crafted website.SummaryThis security update resolves a vulnerability in the JScript and VBScript scripting engines in Microsoft Windows. The vulnerability could allow remote code execution if a...

libpcre: Multiple Vulnerabilities

Background libpcre is a library providing functions for Perl-compatible regular expressions. Description Multiple vulnerabilities have been discovered in libpcre. Please review the CVE identifiers referenced below for details. Impact An attacker can possibly execute arbitrary code or create a...

DSR-150 Router Traffic Interception

The microprogrammed software of the D-Link DSR-150 router does not perform ARP packet authentication for packets transmitted over the IPv4 protocol. This allows for intercepting the traffic processed by this router through ARP spoofing attacks...

Zyxel ZLD Network Interception

The Zyxel ZyWALL USG 300 network interface card/mesh router does not perform ARP packet authentication for packets transmitted over the IPv4 protocol. This allows for intercepting traffic processed by this router through ARP spoofing attacks...

DSR-250 Router Traffic Interception

The microprogrammed software of the D-Link DSR-250 router does not perform ARP packet authentication for packets transmitted over the IPv4 protocol. This allows for intercepting the traffic processed by this router through ARP spoofing attacks...

Fanuc 32i Information Disclosure

The software of FANUC 32i numerical control machines contains a vulnerability that stems from the lack of ARP packet authentication in the IPv4 protocol. This makes the software of FANUC 32i numerical control machines vulnerable to “ARP spoofing” attacks. Exploiting this vulnerability allows a...

Windows DoS

Due to the absence of an ARP packet authentication mechanism in the Windows operating system, a malicious individual can send a false ARP response, thereby replacing the entry in the ARP table and, in turn, changing the routing of network packets to the device whose entry in the ARP table has bee...

Enonic XP: source code security analysis report

Several vulnerabilities were discovered in Enonic AS 'Enonic XP' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из недоверенных источников HttpOnly...

FFmpeg: Multiple vulnerabilities

Background FFmpeg is a complete, cross-platform solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in FFmpeg. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary co...

Cisco Access Point Denial of Service Vulnerability

Cisco Aironet Access Point is a small to medium-sized wireless network access point product. A security vulnerability exists in Cisco Aironet Access Point version 8.2 102.43 software. A remote attacker could cause a denial of service via a constructed ARP packet by exploiting this vulnerability...

CVE-2016-1419

Cisco Access Point devices with software 8.2102.43 allow remote attackers to cause a denial of service device reload via crafted ARP packets, aka Bug ID CSCuy55803...

CVE-2016-3096: Improper Link Resolution Before File Access

The createscript function in the lxccontainer module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on 1 /opt/.lxc-attach-script, 2 the archived container in the archivepath directory, or the 3...

SUSE-RU-2016:1479-1 Recommended update for samba

This update for Samba provides the following fixes: - Fix libads' record session expiry for spnego sasl binds. bsc979268 - Fix NTSTATUSACCESSDENIED when accessing windows public share. - Only validate MIC if 'map to guest' is not being used. - NetAPP SMB servers don't negotiate NTLMSSPSIGN...

LogicalDoc Document Managment System CE: source code security analysis report

Several vulnerabilities were discovered in LogicalDOC 'LogicalDoc Document Managment System CE' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из...