Drupal OpenLucius Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OpenLucius is one of the work management platforms for social communication, documentation and projects. A cross-site scripting vulnerability exists in the Drupal OpenLucius module. An...

KLA10937 Obsolete Adobe Flash Player for Windows

Microsoft released update to address vulnerabilities in Flash Player for Internet Explorer. For details look at KLA10936. Technical details To mitigate this vulnerability you can implement some of workarounds listed in original Microsoft advisory: disable Adobe Flash Player, prevent Adobe FP from...

CVE-2016-4292

When opening a Hangul HShow Document .hpt and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer yet explicitly trust a size from the file when modifying data inside of it. Due to this, an aggressor can corrupt memory outside the bounds...

Atlassian Confluence HTML Injection Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. An HTML injection vulnerability exists in Atlassian Confluence. An attacker can exploit the vulnerability to execute arbitrary script code in the brows...

iOS DEP enrollment may fail when updating the trusted anchor certificates used to trust the SSL connection to the MDM server

After you enable iOS bulk enrollment, the upgrade of the trusted anchor certificates may cause the iOS DEP enrollment or re-enrollment failure. The issue may occur when you change from a self-signed certificate to a public certificate, purchase a certificate from a new provider, or move to an...

Two CVE case study: how to use Android in the trusted zone-vulnerability warning-the black bar safety net

This article from the actual departure, about how to step by step use of Android in the trusted zone TrustZone on. Here I am using a Huawei hisilicon the Trusted Execution Environment Trusted Execution Environment, TEE on. First of all, I found one can gain kernel privilege vulnerabilities, and...

Unspecified Vulnerability in Security Component of Multiple Apple Products (CNVD-2016-12828)

Apple iOS, watchOS, macOS, and tvOS are products of Apple Inc. Apple iOS is an operating system for mobile devices; tvOS is an operating system for smart televisions. security is an information security and privacy component. A security vulnerability exists in the Security component of several...

CVE-2016-2840

An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-7260 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...

Microsoft Windows CVE-2016-7295 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607...

NTP.org 'ntpd' 'decodenetnum' And 'loop counter underrun' DoS Vulnerabilities

NTP.org SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ntp:ntp"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.810221";...

CVE-2016-7428

ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service reject broadcast mode packets via the poll interval in a broadcast packet. Mitigation Only use broadcast mode on trusted networks...

SOL68785753 - ImageMagick vulnerability CVE-2015-8898

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

"Use Windows Session Credentials" options does not work for Veeam ONE Reporter and Business View websites

Challenge When using Internet Explorer , Veeam ONE Reporter and Business View websites keep asking for Windows credentials at logon despite enabling the "Use Windows session credentials" option. NOTE: Business View website is not available since version 9.5 Update 4. It was integrated with the...

Barco ClickShare Cross-Site Scripting Vulnerability

ClickShare is Barco's wireless presentation collaboration system that allows all participants to share content on a centralized conference room screen. A cross-site scripting vulnerability exists in Barco ClickShare because it does not adequately filter user-supplied input. A remote attacker coul...

Computer Associates Service Desk Manager Cross-Site Scripting Vulnerability (CNVD-2016-11327)

CA Service Desk Manager is a service desk manager that is a versatile and comprehensive service support solution. A cross-site scripting vulnerability exists in Computer Associates Service Desk Manager, which can be exploited by an attacker to execute arbitrary script code in a trusted user's...

SOL85307687 - cURL and libcurl vulnerabilities CVE-2014-3613, CVE-2014-3707, and CVE-2014-8150

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Extending Linux Executable Logging With The Integrity Measurement Architecture

Gaining insight into the files being executed on your system is a great first step towards improved visibility on your endpoints. Taking this a step further, centrally storing logs of file execution data so they can be used for detection and hunting provides an excellent opportunity to find evil ...

Microsoft Windows CVE-2016-7224 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to run processes with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Syste...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-7246 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...