Atlassian Confluence Jira 5.9.12 - Persistent Cross-Site Scripting Vulnerability

Tempest Security Intelligence Advisory ADV-3/2016 - Atlassian Confluence version 5.9.12 is vulnerable to persistent cross site scripting because it fails to securely validate user controlled data, thus making it possible for an attacker to supply crafted input in order to harm users. The bug occu...

DEBIAN-CVE-2016-10006

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input a tag that supports style with active content, you could bypass the library protections and supply executable code. The impact is XSS...

php: Int/size_t confusion in SplFileObject::fread

A type confusion issue was found in the SPLFileObject fread function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application...

Trend Micro SafeSync for Enterprise ad.pm id Remote Command Execution

A remote command execution vulnerability exists in Trend Micro Safe Sync for Enterprise ad.pm page. The vulnerability is due to insufficient validation of the user-supplied id parameter. A remote, authenticated attacker could exploit this vulnerability by sending a crafted input to the vulnerable...

vorbis-tools infinite loop vulnerability

Vorbis-tools is used to manipulate and create Vorbis files.OGG Vorbis is a new audio compression format, similar to existing music formats such as MP3. vorbis-tools infinite loop vulnerability. The designer did not set up a numeric legitimacy check, which led to an overflow in the fseek function ...

PHP 7 Unserialization Exception Infinite Loop Denial of Service (CVE-2016-7478)

A Denial of Service vulnerability exists in PHP 7. A remote attacker can exploit this vulnerability by sending specially crafted input to the unserialize function...

Design/Logic Flaw

The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via crafted input to the 1 GeneralCmdRequest, 2 PersistantDataRequest, or 3...

CVE-2016-6646

The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the 1 GetSymmCmdRequest or 2 RemoteServiceHandler class...

Mozilla Firefox and Firefox ESR nsImageGeometryMixin class arbitrary code execution vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. The Mozilla Firefox and Firefox ESR nsImageGeometryMixin class fails to properly execute variables during processing of the INPUT element, allowing remote attackers to exploit the vulnerability t...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

A vulnerability in the Cisco application-hosting framework CAF for Cisco IOS and IOS XE Software with the IOx feature set could allow an authenticated, remote attacker to read arbitrary files on a targeted system. The vulnerability is due to insufficient input validation by the affected framework...

CVE-2016-0370

Cross-site scripting XSS vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product...

The vulnerability of the Android operating system, which allows a perpetrator to trigger a service failure or cause other effects

The vulnerability of the netd process in the Android operating system is related to errors in restrictions and stdio streams. Exploiting this vulnerability allows a malicious actor to cause service failures or other effects through a specially created application...

The vulnerability of the Firefox browser, which allows a hacker to execute arbitrary code

The vulnerability of the js::PreliminaryObjectArray::sweep function in Firefox browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted code, which is incorrectly processed when dealing wit...

PHP7 Unserialization Use After Free

A Use-After-Free vulnerability exists in the Standard PHP library's unserializion of array objects, due to an internal array self-reference. An attacker could exploit this vulnerability by supplying crafted input to a PHP application. Successful exploitation may result in remote execution of...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...

CVE-2016-6252

Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap...

CVE-2016-1182

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

Cross site scripting

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting XSS attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899...

squid: buffer overflow in cachemgr.cgi

A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code...

DEBIAN-CVE-2016-4021

The readbinary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service infinite loop and CPU consumption via crafted input, as demonstrated by the \xa3\x03 string...