DLA-666-1 guile-2.0 - security update

Bulletin has no description...

chromium-browser: scheme bypass

Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages...

PT-2016-6309

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.59 for Windows, Mac, and Linux Google Chrome version 54.0.2840.85 for Android Opera affected versions not specified Description The issue is related to insufficient validation of supplied data in...

chromium -- multiple vulnerabilities

Google Chrome Releases reports: 21 security fixes in this release, including: 645211 High CVE-2016-5181: Universal XSS in Blink. Credit to Anonymous 638615 High CVE-2016-5182: Heap overflow in Blink. Credit to Giwan Go of STEALIEN 645122 High CVE-2016-5183: Use after free in PDFium. Credit to...

guile2 -- multiple vulnerabilities

Ludovic Courtès reports: The REPL server is vulnerable to the HTTP inter-protocol attack The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads...

Nextcloud: URI scheme bypass in mail app lead to HTML content spoof and opener control

Bug When we load a HTML mail from mailbox via api, etc http://nextcloud/index.php/apps/mail/accounts//folders/SU5CT1g=/messages//html Our content will be passed to HTML Purifier to strip malicious XSS patterns. After that, an filter will apply to transform acceptable URI schemes http, https, ftp,...

Debian DLA-643-1 : chicken security update

Multiple vulnerabilities have been found in the CHICKEN Scheme compiler : CVE-2016-6830 Buffer overrun in CHICKEN Scheme's 'process-execute' and 'process-spawn' procedures from the posix unit CVE-2016-6831 Memory leak in CHICKEN Scheme's process-execute and process-spawn procedures For Debian 7...

[SECURITY] [DLA 643-1] chicken security update

Package : chicken Version : 4.7.0-1+deb7u1 CVE ID : CVE-2016-6830 CVE-2016-6831 Multiple vulnerabilities have been found in the CHICKEN Scheme compiler: CVE-2016-6830 Buffer overrun in CHICKEN Schemes "process-execute" and "process-spawn" procedures from the posix unit CVE-2016-6831 Memory leak i...

DLA-643-1 chicken - security update

Bulletin has no description...

Mozilla Firefox Sensitive Information Disclosure Vulnerability (CNVD-2016-08177)

Mozilla Firefox is an open source web browser. Mozilla Firefox fails to properly restrict the 'scheme' parameter in web icon requests, allowing remote attackers to exploit the vulnerability to build malicious web pages that can be parsed by users, which can be used to obtain sensitive information...

Drupal 8 configuration file download vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 4 0 4 Security lab Date: 2016-09-22 0x00 vulnerability overview 1. Vulnerability description Drupal （ https://www.drupal.org is a free open source content management system, recent researchers have found in it 8. x 8.1.10 version found three security vulnerabilities,...

CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

Design/Logic Flaw

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

CVE-2016-5282

Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource...

TYPO3 'data:' URL Scheme Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3. Because the program fails to properly filter user-supplied input, an attacker may be able to exploit the vulnerability to execute arbitrary...

Russian Lawmaker's Son Convicted of Stealing 2.9 Million Credit Card Numbers

The son of a prominent Russian lawmaker has been found guilty in the United States of running a hacking scheme that stole and sold 2.9 million US credit card numbers using Point-of-Sale POS malware, costing financial institutions more than $169 Million. Roman Seleznev, 32, the son of Russian...

jenkins: Open redirect to scheme-relative URLs (SECURITY-276)

Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs...