Ruby on Rails Active Record Security Bypass Vulnerability (Jan 2016) - Linux

Ruby on Rails is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...

Ruby on Rails Active Record Security Bypass Vulnerability (Jan 2016) - Windows

Ruby on Rails is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...

UBUNTU-CVE-2015-8952

The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6 mishandles xattr block caching, which allows local users to cause a denial of service soft lockup via filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samb...

MS16-120: Description of the Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012: October 11, 2016

MS16-120: Description of the Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012: October 11, 2016 View products that this article applies to. Summary This update resolves vulnerabilities in Microsoft .NET Framework. The vulnerabilities could allow remote code execution if ...

MS16-107: Description of the security update for Outlook 2010: September 13, 2016

MS16-107: Description of the security update for Outlook 2010: September 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...

MS16-107: Description of the security update for PowerPoint Viewer 2010: September 13, 2016

MS16-107: Description of the security update for PowerPoint Viewer 2010: September 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities,...

MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016

MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilitie...

DEBIAN-CVE-2016-6316

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

GitLab: XSS On meta tags in profile page

The profile page https://gitlab.com/u/ does not properly sanitize quotation marks, allowing for injection of attributes into the meta tags. This allows for redirection to phishing sites and other various nefarious things. I've managed to get my profile page to redirect to Bing by setting my bio t...

kernel: Permission bypass on overlayfs during copy_up

The ovlsetattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application...

Clicky by Yoast <= 1.5 - Minor Security Improvements

From the changelog: - Only allow expected characters in user settings thanks to a report by Netsparker. - Proper escaping of translated string in image attributes...

Cisco IOS XE Software Border Gateway Protocol Message Processing Denial of Service Vulnerability

A vulnerability in Border Gateway Protocol BGP message processing functions of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of crafted BGP attributes. An attacker could exploit this...

USN-3024-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

Google Chrome browser contains a vulnerability related to memory reuse after deallocation use-after-free error in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp of Blink. Exploiting this vulnerability allows malicious actors to cause system failures or other adverse...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to memory reclamation use-after-free error in the AttributeSetter function within the bindings/templates/attributes.cpp section of the Blink bindings for Google Chrome. Exploiting this vulnerability allows malicious actors to cause servic...

Medium: kernel

Issue Overview: A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel...

MS16-070: Description of the security update for Visio Viewer 2007: June 14, 2016

MS16-070: Description of the security update for Visio Viewer 2007: June 14, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...

MS16-070: Description of the security update for OneNote 2016: June 14, 2016

None None...

Debian DLA-496-1 : ruby-activerecord-3.2 security update

CVE-2015-7577 activerecord/lib/activerecord/nestedattributes.rb in Active Record does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature. For Debian 7 'Wheezy', this problem have...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2016-03733)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...