baserCMS plugin Mail vulnerable to cross-site scripting

Overview baserCMS provided by baserCMS User Group is an opensource content management system. baserCMS and bundled plugin Mail contain a stored cross-site scripting vulnerability. Isao Takaesu of Mitsui Bussan Secure Directions, Inc. and Norihiko Hirukawa of FiveDrive Inc. reported this...

Medical Devices Should Withstand Rigor, Expert Says

CAMBRIDGE, Ma.—When it comes to managing medical device security risk, hospital administrators should focus on weathering the storm and not necessarily prevention, Dr. Kevin Fu, a noted medical device security expert, encouraged this week. “How do you fail gracefully when things go wrong? Will yo...

3Pixels Media Administration Page Bypass Vulnerability

3Pixels is a media software that combines technology and consulting services. A security bypass vulnerability exists in 3Pixels Media. An attacker could exploit this vulnerability to bypass security restrictions and perform unauthorized operations...

RHEL 6 : Virtualization Manager (RHSA-2016:1929)

An update for org.ovirt.engine-root is now available for RHEV Manager version 3.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2016-6373

Cisco Cloud Services Platform (CSP) 2100 web GUI vulnerability (CVE-2016-6373) affects CSP2100 2100 series running 2.0 and 2.x prior to 2.1.0. An authenticated remote attacker can inject commands via crafted platform requests to execute arbitrary OS commands with root privileges. The issue stems ...

Moderate: Red Hat Security Advisory: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

An update for org.ovirt.engine-root is now available for RHEV Manager version 3.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Synology DiskStation Manager (DSM) Web Administration Interface Default Credentials

The web administration interface for the Synology DiskStation Manager DSM application running on the remote host uses a default blank password for the administrator account. A remote attacker can exploit this to gain administrative access to the web interface. C Tenable Network Security, Inc...

[SECURITY] Fedora 23 Update: phpMyAdmin-4.6.4-2.fc23

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

[SECURITY] Fedora 24 Update: phpMyAdmin-4.6.4-2.fc24

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

CVE-2016-5105

The megasasdcmdcfgread function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface MFI command...

How to Control Receiver Self-Service.exe Launch

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information How to control or configure Receiver Self-Service.exe launching or refresh time. SelfServicePlugin runs...

How to Configure Local Access for HTML5x Using Receiver

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. This article describes how to configure local access using Citrix Receiver for HTML5 1.0. Note : The...

ZKTeco ZKAccess Security System 5.3.1 Persistent Cross Site Scripting

i?!-- ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 5.3.12252 Summary: ZKAccess Systems are built on flexible, open technology to provide...

Drupal Administration Views Module Access Privilege Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Administration Views is one of the modules used to replace the administration overview or list pages. An access rights bypass vulnerability exists in the Drupal Administration Views...

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

Important: mysql55

Issue Overview: It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a clien...

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

Snort Back Orifice BOPing - ver 2 (CVE-1999-0660)

BOPing is a network scanner for computers where the Back Orifice remote administration program is installed. Use of this scanner might be a preliminary step before attempting to take control over the system using the Back Orifice program.This protection detects and blocks use of the BOPing scanne...