PT-2016-6202

Name of the Vulnerable Software and Affected Versions OpenStack Murano versions prior to 1.0.3 liberty and prior to 2.0.1 mitaka Murano-dashboard versions prior to 1.0.3 liberty and prior to 2.0.1 mitaka python-muranoclient versions prior to 0.7.3 liberty and prior to 0.8.5 mitaka Description The...

TicketSwap - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application TicketSwap published at the 'play' market has multiple vulnerabilities...

WordPress plugin wp-business-intelligence remote code execution vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A remote code execution vulnerability exists in the WordPress plugin wp-business-intelligence. Failure to...

Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities

SEC Consult has also released a blog post describing the attack scenarios of the vulnerabilities within this advisory in detail and a video which shows the remote attack. Exploit code has been developed as well but will not be released for now. Blog:...

Multiple IBM DB2 Products Local Lift Vulnerabilities

IBM DB2 is a relational database management system from IBM in the United States. Multiple IBM DB2 products fail to properly validate input prior to loading into the library, allowing a local attacker to exploit the vulnerability to gain root privileges by constructing malicious libraries in a...

Offside.uz - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Offside.uz published at the 'play' market has multiple vulnerabilities...

InMobi Ad report (Mobile) - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application InMobi Ad report Mobile published at the 'play' market has multiple vulnerabilities...

Debian DSA-3670-1 : tomcat8 - security update

Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

[SECURITY] [DSA 3669-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3669-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 15, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3670-1 (tomcat8 - security update)

Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. OpenVAS Vulnerability Test $Id: deb3670.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3670-1 using nvtgen 1.0 Script...

rubygem-activerecord: unsafe query generation in Active Record

A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application...

Dailyworkout - Free - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Dailyworkout - Free published at the 'play' market has multiple vulnerabilities...

PHP 'ext/gd/gd.c' Heap Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language. PHP 'ext/gd/gd.c' suffers from a heap buffer overflow vulnerability due to the program failing to adequately filter user-supplied data. Allowing an attacker to exploit the vulnerability would allow execution of arbitrary script co...

Университет ИТМО - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Университет ИТМО published at the 'play' market has multiple vulnerabilities...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)

2.8.6 is a security and bugfix release. Included in the list of fixed issues in 2.8.5 are two CVEs : - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed Several issues with database migrations are also addressed in this...

CVE-2016-6186

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

PYSEC-2016-2

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

PYSEC-2016-2

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

SAP TREX Directory Traversal Vulnerability

SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. A directory traversal vulnerability exists in SAP TREX because the program fails to adequately filter user-submitted input. An attacker could leverage the directory traversal character '...' The vulnerabili...

Stopwatch and Timer - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Stopwatch and Timer published at the 'play' market has multiple vulnerabilities...