CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

Cross site request forgery (csrf)

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF Cross Style Request Forgery style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a...

FortiOS Reflected XSS in Web Proxy Disclaimer Response web page

A reflected XSS vulnerability exists in FortiOS web proxy disclaimer response web pages, potentially exploitable by an unauthenticated attacker, via sending a maliciously crafted URL to the victim. The victim visiting the malicious URL would then have arbitrary javascript code executed in the...

CVE-2017-1230

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This weakness may allow attackers to expose sensitive information by guessing tokens or identifiers. IBM X-Force ID: 123909...

FortiOS web GUI logindisclaimer redir parameter XSS vulnerability

A reflected XSS vulnerability exists in FortiOS web GUI "Login Disclaimer" redir parameter. It is potentially exploitable by a remote unauthenticated attacker, via sending a maliciously crafted URL to a victim who has an open session on the web GUI. Visiting that malicious URL may cause the...

CVE-2017-11825

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

Remote code execution

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

CVE-2017-11825

Microsoft Office 2016 Click-to-Run C2R and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka "Microsoft Office Remote Code Execution Vulnerability...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2017:2659-1)

This update for krb5 fixes several issues. This security issue was fixed : - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracte...

SUSE-SU-2017:2659-1 Security update for krb5

This update for krb5 fixes several issues. This security issue was fixed: - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995 These non-security issues were fixed: - Set 'rdns' and 'dnscanonicalizehostname' to false in krb5.conf in order to improve clie...

PeaZip Compressed Filename Command Injection (CVE-2009-2261)

A command injection vulnerability exists in PeaZip. A remote attacker may exploit this vulnerability by sending a specially crafted Zip file to a target user, and convince him to open this file with PeaZip. Successful exploitation would allow an attacker to execute commands in the security contex...

DEBIAN-CVE-2017-11462

Double free vulnerability in MIT Kerberos 5 aka krb5 allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error...

CVE-2017-11462

CVE-2017-11462 is a reported double free vulnerability in MIT Kerberos 5 (krb5) with unspecified impact. The initial description states a double free allows attackers to cause unspecified effects via automatic deletion of security contexts on error. Connected documents reiterate the issue as a do...

Microsoft SharePoint Server 2010 Excel Services Remote Code Execution Vulnerability (KB4011056)

This host is missing an important security update according to Microsoft KB4011056 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Excel Viewer 2007 Service Pack 3 Remote Code Execution Vulnerability (KB4011065)

This host is missing an important security update according to Microsoft KB4011065 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

CVE-2017-11462

Double free vulnerability in MIT Kerberos 5 aka krb5 allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error...

Apache2Triad 1.5.4 CSRF / XSS / Session Fixation

Credits: John Page AKA hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt + ISR: ApparitionSec Vendor: =============== apache2triad.net https://sourceforge.net/projects/apache2triad/ Product:...