CVE-2016-5570

Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via vectors related to AD Utilities...

Auto_EAP - Automated Brute-Force Login Attacks Against EAP Networks

AutoEAP.py is a script designed to perform automated brute-force authentication attacks against various types of EAP networks. These types of wireless networks provide an interface to facilitate password guessing of domain credentials as radius servers check authentication against Active Director...

New Relic: Hyperlink Injection on adding active users

@japz discovered an issue with how some email clients render text. This issue was determined to be very low or no risk and was subsequently removed from our program's scope...

How To Configure Single Sign-on for Receiver for ChromeOS

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Citrix Receiver for Chrome now supports single sign-on SSON on Chromebook devices and Citrix Virtual...

FreeBSD : Rails 4 -- Unsafe Query Generation Risk in Active Record (7e61cf44-6549-11e6-8286-00248c0c745d)

Ruby Security team reports : There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155. %NASLMINLEVEL 70300 ...

Ruby on Rails Active Support XSS Vulnerability (Jun 2015) - Linux

Ruby on Rails is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails Active Support DoS Vulnerability (Jun 2015) - Linux

Ruby on Rails is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails Active Record SQLi Vulnerability (Aug 2016) - Linux

Ruby on Rails is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails"...

Ruby on Rails Active Support XSS Vulnerability (Jun 2015) - Windows

Ruby on Rails is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Unable to Delete Credentials

Challenge When attempting to delete credentials from the credentials manager, a message box states: Unable to delete credentials because they are currently in use. See details for more info. Cause You cannot delete a record that is already used for any component in the backup infrastructure...

Cisco IOS XE Multicast Routing Multiple DoS (cisco-sa-20160928-msdp)

According to its self-reported version number and configuration, the remote Cisco IOS XE device is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper validation of packets encapsulated in a PIM register message. An unauthenticated,...

Microsoft Passport-Azure-AD for Node.js library security bypass vulnerability

Microsoft Azure Active Directory Passport a.k.a. Passport-Azure-AD library for Node.js is a library collection of Passport policies for Node.js the web application platform from Microsoft, USA, which is used to help integrate node applications with Windows Azure Active Directory, a service that...

Cisco IOS Multicast Routing Multiple DoS (cisco-sa-20160928-msdp)

According to its self-reported version number and configuration, the remote Cisco IOS device is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper validation of packets encapsulated in a PIM register message. An unauthenticated,...

Debian DLA-642-1 : ruby-activerecord-3.2 security update

Active Record in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. For Debian 7 'Wheezy', these problems...

How to Verify Active Users or ICA Users on Citrix Gateway

This article describes how to verify Active Users or ICA User on Citrix Gateway...

Symantec Messaging Gateway Directory Traversal Vulnerability (SYM16-016) - Active Check

Symantec Messaging Gateway is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

DLA-641-1 ruby-activesupport-3.2 - security update

Bulletin has no description...

CVE-2016-7191

The Microsoft Azure Active Directory Passport aka Passport-Azure-AD library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token...

Authentication flaw

The Microsoft Azure Active Directory Passport aka Passport-Azure-AD library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token...

CVE-2016-7191

The Microsoft Azure Active Directory Passport aka Passport-Azure-AD library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token...