MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016

MS16-107: Description of the security update for PowerPoint 2013: September 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilitie...

DEBIAN-CVE-2016-6316

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

PT-2016-3696

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.3.90 Description The issue allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate event from template attributes.ctp. Recommendation...

GitLab: XSS On meta tags in profile page

The profile page https://gitlab.com/u/ does not properly sanitize quotation marks, allowing for injection of attributes into the meta tags. This allows for redirection to phishing sites and other various nefarious things. I've managed to get my profile page to redirect to Bing by setting my bio t...

CVE-2016-5262: Improper Neutralization of Input During Web Page Generation

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting XSS...

kernel: Permission bypass on overlayfs during copy_up

The ovlsetattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application...

Clicky by Yoast <= 1.5 - Minor Security Improvements

From the changelog: - Only allow expected characters in user settings thanks to a report by Netsparker. - Proper escaping of translated string in image attributes...

Cisco IOS XE Software Border Gateway Protocol Message Processing Denial of Service Vulnerability

A vulnerability in Border Gateway Protocol BGP message processing functions of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of crafted BGP attributes. An attacker could exploit this...

PT-2016-4807

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4 and 15.0 through 15.5 Cisco IOS XE versions 3.13 through 3.17 Description A vulnerability in Border Gateway Protocol BGP message processing functions could allow an authenticated, remote attacker to cause an affected...

USN-3024-1: Tomcat vulnerabilities

It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

Google Chrome browser contains a vulnerability related to memory reuse after deallocation use-after-free error in the HTMLBodyElement::insertedInto function in core/html/HTMLBodyElement.cpp of Blink. Exploiting this vulnerability allows malicious actors to cause system failures or other adverse...

The vulnerability of Google Chrome browser allows a malicious actor to trigger a service failure.

The Google Chrome browser contains a vulnerability related to memory reclamation use-after-free error in the AttributeSetter function within the bindings/templates/attributes.cpp section of the Blink bindings for Google Chrome. Exploiting this vulnerability allows malicious actors to cause servic...

Medium: kernel

Issue Overview: A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel...

MS16-070: Description of the security update for Visio Viewer 2007: June 14, 2016

MS16-070: Description of the security update for Visio Viewer 2007: June 14, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see...

MS16-070: Description of the security update for OneNote 2016: June 14, 2016

None None...

IBM UrbanCode Deploy Information Disclosure Vulnerability (CNVD-2016-03733)

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the complex application in different environments, su...

Debian DLA-496-1 : ruby-activerecord-3.2 security update

CVE-2015-7577 activerecord/lib/activerecord/nestedattributes.rb in Active Record does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature. For Debian 7 'Wheezy', this problem have...

[SECURITY] [DLA 496-1] ruby-activerecord-3.2 security update

Package : ruby-activerecord-3.2 Version : 3.2.6-5+deb7u2 CVE ID : CVE-2015-7577 Debian Bug : N/A CVE-2015-7577 activerecord/lib/activerecord/nestedattributes.rb in Active Record does not properly implement a certain destroy option, which allows remote attackers to bypass intended change...

CVE-2016-1858

WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, improperly tracks taint attributes, which allows remote attackers to obtain sensitive information via a crafted web site...

Linux kernel privilege acquisition vulnerability (CNVD-2016-02786)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. aufs is one of the federated file system modules. A privilege-acquisition vulnerability exists in the aufs module of Linux kernel versions 3.x and 4.x. The vulnerability stems...