FreeBSD : nginx -- a specially crafted request might result in worker process crash (36cf7670-2774-11e6-af29-f0def16c5c1b)

Maxim Dounin reports : A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file. %NASLMINLEVEL 703...

UBUNTU-CVE-2016-4450

os/unix/ngxfiles.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service NULL pointer dereference and worker process crash via a crafted request, involving writing a client request body to a temporary file...

Apache Tomcat 6.0.x < 6.0.45 / 7.0.x < 7.0.65 / 8.0.x < 8.0.27 Directory Traversal

Binary data 9317.pasl...

Apple iOS/watchOS/tvOS and OS X El Capitan IOHIDFamily Arbitrary Code Execution Vulnerability

Apple iOS is an operating system for Apple's cell phones.OS X El Capitan is a dedicated operating system for Mac computers.watchOS is a smartwatch operating system. A security vulnerability in IOHIDFamily in Apple iOS, watchOS, and OS X El Capitan allows an attacker to submit a special request to...

Apple iOS/watchOS/tvOS and OS X El Capitan libxml2 arbitrary code execution vulnerability (CNVD-2016-03524)

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a dedicated operating system developed for Mac computers. watchOS is a smartwatch operating system. A security vulnerability in libxml2 in Apple iOS, watchOS, and OS X El Capitan could be exploited by an attacker to submi...

Apple iOS/watchOS/tvOS and OS X El Capitan libxml2 arbitrary code execution vulnerability (CNVD-2016-03522)

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a dedicated operating system developed for Mac computers. watchOS is a smartwatch operating system. A security vulnerability in libxml2 in Apple iOS, watchOS, and OS X El Capitan could be exploited by an attacker to submi...

Cisco Web Security Appliance HTTP POST Denial of Service Vulnerability

A vulnerability that occurs when parsing an HTTP POST request with Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS vulnerability due to the proxy process becoming unresponsive. The vulnerability is due to a lack o...

The vulnerability of the microprogramming software of the Cisco wireless LAN controller allows a intruder to execute arbitrary code.

The vulnerability of Cisco wireless LAN controllers’ microprogramming software arises from buffer overflows in the redirection system. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted HTTP request...

Botan BER Decoder Security Bypass Vulnerability

Botan is a C++ library of cryptographic algorithms that supports AES, DES, SHA-1, RSA, DSA and Diffie-Hellman. A security vulnerability in the Botan BER decoder allows remote attackers to exploit the vulnerability by submitting a special request to read untrusted ASN.1 data...

The vulnerability of the SAP NetWeaver software integration platform allows a perpetrator to trigger a service failure.

The vulnerability of the Enqueue Server component of the SAP NetWeaver software integration platform is related to errors in the code. Exploiting this vulnerability can allow a malicious actor to cause service failures through a specially created request...

ImageMagick Unauthorized File Deletion (CVE-2016-3715)

A file deletion vulnerability has been reported in ImageMagick. The vulnerability is due to insufficient filtering of shell characters. A remote attacker may exploit this issue by sending a crafted request containing such characters. Successful exploitation would allow attackers to delete files i...

Cisco Prime Collaboration Assurance Open Redirect Vulnerability

A vulnerability in the web interface of Cisco Prime Collaboration Assurance Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of HTTP request parameters by the affected software. An attacker...

PHP 'mb_strcut()' Function Denial of Service Vulnerability

PHP is an open source general-purpose computer scripting language. The PHP 'mbstrcut' function fails to properly handle string formatting, allowing a remote attacker to exploit the vulnerability by submitting a special request to crash the application...

Squid HTTP Caching Proxy Buffer Overflow Vulnerability (CNVD-2016-02509)

Squid is a suite of proxy server and web caching server software. Squid suffers from a buffer overflow vulnerability that could be exploited by a remote attacker to submit a special request, crash an application, or execute arbitrary code...

CVE-2016-4015

The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service process crash via a crafted request, aka SAP Security Note 2258784...

CVE-2016-3656

The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service service crash via a crafted request...

ISC BIND buffer.c REQUIRE Assertion Failure Denial of Service (CVE-2015-8705)

A denial-of-service vulnerability has been reported in BIND DNS package bind9. The vulnerability is due to improper conversion of OPT resource records ECS options to text format. A remote, unauthenticated attacker could exploit this vulnerability against Recursive or Authoritative DNS servers tha...

SAP NetWeaver AS JAVA Internet Communication Manager Component Denial of Service Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications. SAP NetWeaver AS Application Server Java is an application server that runs in NetWeaver and is based on the Java programming language. Internet...

Ecava IntegraXor Report save SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of save report requests. The vulnerability is caused by the lack of input...

CVE-2016-3980

The Java Startup Framework aka jstart in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service process crash via a crafted HTTP request, aka SAP Security Note 2259547...