CVE-2016-2156

calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a...

BitTorrent API Cross Site Scripting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent and uTorrent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. These applications expose a web service...

Debian DSA-3580-1 : imagemagick - security update (ImageTragick)

Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with contro...

Katello: Authenticated sql injection via sort_by and sort_order request parameter

An input sanitization flaw was found in the scoped search parameters sortby and sortorder in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database...

[SECURITY] [DSA 3580-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3580-1 [email protected] https://www.debian.org/security/ Luciano Bello May 16, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3580-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3580-1 [email protected] https://www.debian.org/security/ Luciano Bello May 16, 2016 https://www.debian.org/security/faq -...

DSA-3580-1 imagemagick - security update

Bulletin has no description...

[SECURITY] Fedora 22 Update: openvas-gsa-6.0.10-3.fc22

The Greenbone Security Assistant GSA is a lean web service offering a user web interface for the Open Vulnerability Assessment System OpenVAS. The GSA uses XSL transformation style-sheets that converts OMP responses from the OpenVAS infrastructure into presentable HTML...

The vulnerability of the ScreenOS operating system, which allows a hacker to trigger a service failure

The vulnerability of the ScreenOS operating system’s administrative web service interface exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures by using specially crafted SSL packets...

Wireshark MS-WSP Parser Integer Symbol Error Vulnerability

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. An integer sign error vulnerability exists in the epan/dissectors/packet-mswsp.c file in the MS-WSP parser in versions 2.0.x prior to Wireshark 2.0.3. A remote attacker can exploit...

Juniper Junos J-Web Service Multiple Vulnerabilities (JSA10723)

According to its self-reported version number, the remote Juniper Junos device is affected by multiple flaws in the J-Web service that allow an unauthenticated, remote attacker to conduct a cross-site request forgery XSRF attack or to cause a denial of service condition. TRUSTED...

Wireshark MS-WSP parser denial of service vulnerability (CNVD-2016-02654)

Wireshark formerly known as Ethereal is a suite of network packet analysis software developed by the Wireshark team. A security vulnerability in the epan/dissectors/packet-mswsp.c file in the MS-WSP parser in versions 2.0.x prior to Wireshark 2.0.3 can be exploited by remote attackers to cause a...

用友某系统多处注入漏洞打包

简要描述： wooyun搜了一下，没有人提，来一发。 详细说明： 首先，该接口是无需权限访问的。 已http://.../bugs/wooyun-2010-0178322为例： ...:8080/uapws/service/nc.itf.bd.crm.ICurrtypeExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IInvbasdocExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IMeasdocExportToCrmService?wsd...

CVE-2016-2171

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to 1 add, 2 edit, or 3 delete users via the REST API...

op5 v7.1.9 Configuration Command Execution

op5 an open source network monitoring software. The configuration page in version 7.1.9 and below allows the ability to test a system command, which can be abused to run arbitrary code as an unpriv user. Module Options msf use exploit/linux/http/op5/configexec msf undefinedconfigexec show actions...

Updated moodle packages fix security vulnerability

In Moodle before 2.8.11, teachers who otherwise were not supposed to see students' emails could see them in the participants list CVE-2016-2151. In Moodle before 2.8.11, Moodle traditionally trusted content from external DB, however it was decided that external datasources may not be aware of web...

PHP has an unspecified vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. The language supports multiple syntaxes, multiple databases and operating systems, and support for C, C++ for program extensions and so on. A...

The vulnerability of the Moodle learning management system allows a hacker to gain access to confidential information about course participants.

The vulnerability in the coreenrolgetenrolledusers web service of the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to confidential information about course participan...

EMC Documentum xCP SQL Query Injection Vulnerability

EMC Documentum is an enterprise document and image management tool that makes the creation, modification, tracking and utilization of documents in business processes efficient, standardized and rigorous. EMC Documentum xCP fails to properly handle XCP REST requests, allowing remote attackers to...

Ipswitch MOVEit DMZ Username Enumeration Vulnerability

Ipswitch MOVEit is an automated file transfer system from Ipswitch, Inc. in the U.S. DMZ is one of the versions. Ipswitch MOVEit DMZ according to the account exists or not to return different error messages, remote attackers can send a series of SOAP to the machine.aspx file please enumerate the...