CVE-2017-5345: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/lib/Control/Ajax/tags-ajax.control.php in GeniXCMS 0.0.8 allows remote authenticated editors to execute arbitrary SQL commands via the term parameter to the default URI...

PT-2017-16446

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.8 Description The issue allows remote authenticated editors to execute arbitrary SQL commands. This is achieved by exploiting the term parameter in the default URI, specifically in the...

Multiple Vulnerabilities in Drupal Permissions by Term

The Permissions by Term module is a module from Drupal. The module provides both front-end and back-end functionality. No programming skills are required, and the module can be handled by the Drupal site builder through a user interface in a web browser. Permissions by Term module version 8.x-1.1...

Google Patches Android 'Custom Boot Mode' Vulnerability

A high-risk Android custom boot mode vulnerability was one of many bugs patched by Google as part of its January Android Security Bulletin released earlier this week. On Thursday, the IBM security team that discovered the vulnerability disclosed details about the flaw which leaves Nexus 6 and 6P...

Updated drupal packages fix security vulnerability

Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...

MGASA-2016-0413 Updated drupal packages fix security vulnerability

Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11262)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An SQL injection vulnerabilit...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005

Description Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing...

PT-2016-7725

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 patch1 Description The issue arises from untrusted input being passed into the getSearchResults method in the /framework/modules/notfound/controllers/notfoundController.php file. This method, defined in the search...

USN-3128-2 linux-lts-xenial vulnerability

USN-3128-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a...

Long Term Evolution Network Information Disclosure Vulnerability

Long Term Evolution LTE is a 4G wireless broadband technology developed by the Third Generation Partnership Project 3GPP project team. An information disclosure vulnerability exists in LTE devices. An attacker could exploit this vulnerability to obtain sensitive information and execute a...

USN-3106-2 linux-lts-xenial vulnerability

USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the memory manager of the Linux...

Russian Lawmaker's Son Convicted of Stealing 2.9 Million Credit Card Numbers

The son of a prominent Russian lawmaker has been found guilty in the United States of running a hacking scheme that stole and sold 2.9 million US credit card numbers using Point-of-Sale POS malware, costing financial institutions more than $169 Million. Roman Seleznev, 32, the son of Russian...

Fedora 23 : drupal7-views (2016-ed5f606dde)

Fixes Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036 Changes since 7.x-3.13 : - Adding field handlers for statistics fields - \2200309 by helmo: Changed invalid placeholder from 'handler' to 'extender'. - \2708535 by stefan.r: Allow users to sort on a specific language, showing it...

panorama.es XSS vulnerability

Vulnerable URL: http://www.panorama.es/rentals/results/rentaltype/long%20term%20rentals/?dfa=%5B%27http%3A%2F%2Fwww.panorama.es%2Frentals%2Fresults%2F%27%5D%22%27%3E%20%3C/form%3E%3Cscript%3Ealert%22OPENBUGBOUNTY%22;%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017...

Debian DLA-487-1 : debian-security-support - Long term security support update

The Debian Long Term Support LTS Team is unable to continue supporting different packages in the extended life cycle of Wheezy LTS. The debian-security-support package provides the check-support-status tool that helps to warn the administrator about installed packages whose security support is...

CloudBees Jenkins CI and Jenkins LTS redirection vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

CloudBees Jenkins CI and Jenkins LTS Information Disclosure Vulnerability (CNVD-2016-03162)

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

UBUNTU-CVE-2016-4074

The jvdumpterm function in jq 1.5 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted JSON file. This issue has been fixed in jq 1.6rc1-r0...

PT-2016-5837

Name of the Vulnerable Software and Affected Versions jq versions 1.5 Description The issue allows remote attackers to cause a denial of service, resulting in stack consumption and application crash, via a crafted JSON file. This is due to a problem in the jv dump term function. Recommendations F...