GLSA-201611-10 : libuv: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201611-10 libuv: Privilege escalation It was discovered that libuv does not call setgroups before calling setuid/setgid. If this is not called, then even though the uid has been dropped, there may still be groups associated that...

Atlassian JIRA 6.4.x < 6.4.10 CSRF / XSRF (Bar Mitzvah)

Binary data 9736.prm...

Atlassian JIRA 6.1.x < 6.1.5 Mutliple CSRF / XSRF

Binary data 9733.prm...

CVE-2016-9136

Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83acfa950ec8a8a89 allows context-dependent attackers to obtain sensitive information by using the "crafted JavaScript" approach, related to a "Buffer Over-read" issue...

Mozilla Firefox < 49.0 Multiple Vulnerabilities

Binary data 9624.prm...

CVE-2016-7798

The openssl gem for Ruby uses the same initialization vector IV in GCM Mode aes--gcm when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism. Mitigation A possible workaround to this flaw is, when using aes-256-gcm mod...

Flash Player < 11.2.202.635 / 18.0.0.375 / 23.0.0.162 Multiple Vulnerabilities (APSB16-29)

Binary data 9603.prm...

Format string

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings...

CVE-2016-6537

AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings...

CVE-2016-6261

The idnatoascii4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service out-of-bounds read and crash via 64 bytes of input...

Google Chrome < 52.0.2743.116 Multiple Vulnerabilities

Binary data 9490.pasl...

Mozilla Firefox < 48.0 Multiple Vulnerabilities

Binary data 9484.prm...

Mozilla Firefox ESR < 45.3 Multiple Vulnerabilities

Binary data 9485.prm...

CVE-2016-5116

The CVE applies to the GD Graphics Library (libgd) prior to version 2.2.0, used in certain PHP 5.5.x configurations. The flaw in gd_xbm.c allows a long XBM image name to read process memory or trigger a stack-based buffer under-read, causing potential information disclosure or denial of service. ...

Foxit Reader < 7.3.4 Multiple Vulnerabilities

Binary data 9468.prm...

cURL < 7.48.0 Integer Overflow Issue

Binary data 800142.prm...

Oracle Java SE < 7 Update 25 Arbitrary Code Execution

Binary data 9350.prm...

CVE-2016-2175: Undefined Security Weakness

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted PDF...

CVE-2016-3693

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method...

CVE-2016-3693

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method...