EMC RSA Adaptive Authentication Cross-Site Scripting Vulnerability (CNVD-2016-08081)

EMC RSA Adaptive Authentication On-Premise is a comprehensive, risk-based authentication and fraud detection platform from EMC Corporation.Case Management application is one of the applications used to study and analyze cases. A cross-site scripting vulnerability exists in the Case Management...

CVE-2016-0925

Cross-site scripting XSS vulnerability in the Case Management application in EMC RSA Adaptive Authentication On-Premise before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or...

CVE-2016-0925

The CVE-2016-0925 entry describes a cross-site scripting (XSS) vulnerability in the Case Management component of EMC RSA Adaptive Authentication (On-Premise). Affected versions include 6.0.2.1.SP3.P4 HF210; 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50; and 7.2.x before 7.2.0.0.SP0.P0 HF20. The issu...

Google Android Local Elevation of Privilege Vulnerability (CNVD-2016-07436)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A local elevation of privilege vulnerability exists in SMS in Android. A local attacker can exploit this vulnerability to gain elevated privileges...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

postgresql: CASE/WHEN with inlining can cause untrusted pointer dereference

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code...

SUSE SLES11 Security Update : pam (SUSE-SU-2016:1645-1)

This update for pam fixes two security issues. These security issues were fixed : - CVE-2015-3238: pamunix in conjunction with SELinux allowed for DoS attacks bsc934920. - CVE-2013-7041: Compare password hashes case-sensitively bsc854480. The update package also includes non-security fixes. See...

Tor Update Fixes ReachableAddresses Problem

The Tor Project on Wednesday updated its software package to version 0.2.8.7 and fixed a number of issues, including a bug it calls “important” in the ReachableAddresses option. ReachableAddresses is a list of IP addresses and ports that are permitted by a firewall; admins can set IP ranges and...

PostgreSQL 9.1.x < 9.1.23 / 9.2.x < 9.2.18 / 9.3.x < 9.3.14 / 9.4.x < 9.4.9 / 9.5.x < 9.5.4 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.23, 9.2.x prior to 9.2.18, 9.3.x prior to 9.3.14, 9.4.x prior to 9.4.9, or 9.5.x prior to 9.5.4. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists that allows an...

USN-3066-1 postgresql-9.1, postgresql-9.3, postgresql-9.5 vulnerabilities

Heikki Linnakangas discovered that PostgreSQL incorrectly handled certain nested CASE/WHEN expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. CVE-2016-5423 Nathan Bossart discovered that PostgreSQL incorrectly handled speci...

Debian DSA-3646-1 : postgresql-9.4 - security update

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2016-5423 Karthikeyan Jambu Rajaraman discovered that nested CASE-WHEN expressions are not properly evaluated, potentially leading to a crash or allowing to disclose portions of server memory. - CVE-2016-5424...

[SECURITY] [DSA 3646-1] postgresql-9.4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3646-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 11, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3646-1 (postgresql-9.4 - security update)

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-5423 Karthikeyan Jambu Rajaraman discovered that nested CASE-WHEN expressions are not properly evaluated, potentially leading to a crash or allowing to disclose portions of server memory. CVE-2016-5424 Nath...

UBUNTU-CVE-2016-5423

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service NULL pointer dereference and server crash, obtain sensitive memory information, or possibly execute arbitrary code via 1 a...

PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities

PostgreSQL project reports: Security Fixes nested CASE expressions + database and role names with embedded special characters CVE-2016-5423: certain nested CASE expressions can cause the server to crash. CVE-2016-5424: database and role names with embedded special characters can allow code...

Sophos Mobile Control 3.5.0.3 Open Reverse Proxy

Application: Sophos Mobile Control EAS Proxy Versions Affected: 3.5.0.3 Vendor URL: https://www.sophos.com/ Bugs: Open Reverse Proxy Sent: 30.06.2016 Reported: 05.07.2016 Vendor response: 13.07.2016 Published BugFix by vendor: 28.07.2016 Date of Public Advisory: 05.08.2016 Reference: Sophos Case...

Red Team Tool Roundup

In many cases Red Team tools are not written because someone feels like writing a tool, or wakes up one morning thinking, “I want to write a tool today”. Red Teamers generally identify tedious tasks in their methodology and then create tools that automate these tasks for current and future...

Yahoo Ordered to Explain Data Gathering Procedures in Deleted Email Case

Yahoo has been given until August 31 to comply with a court order asking how the company was able to recover emails that were presumed deleted. Yahoo’s policy guide claims it cannot recover emails from a user’s account that have been deleted but defense lawyers for a convicted U.K. drug trafficke...

Edward Snowden Designs an iPhone Case to Detect & Block Wireless Snooping

We just cannot imagine our lives without smartphones, even for a short while, and NSA whistleblower Edward Snowden had not owned a smartphone since 2013 when he began leaking NSA documents that exposed the government's global surveillance program. Snowden fears that cellular signals of the...