SUSE-SU-2016:2019-1 Security update for rubygem-bson-1_11, rubygem-easy_diff, rubygem-redcarpet, and rubygem-sprockets-2_11

This update for rubygem-bson-111, rubygem-easydiff, rubygem-redcarpet, and rubygem-sprockets-211 fixes the following issues: - Avoid monodb data injection bnc933961, CVE-2015-4410 - Fixes merging of Arrays of Hashes bsc982364 - Fix XSS via autolinking of untrusted markdown bsc926328...

JDK: J9 JVM allows code to invoke non-public interface methods

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...

Multiple I-O DATA Products Cross-Site Scripting Vulnerabilities

The I-O DATA WN-G300R is a wireless LAN router product from I-O DATA Japan. A cross-site scripting vulnerability exists in multiple I-O DATA WN-G300R products, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to...

Cisco IOS XE Multiple OpenSSL Vulnerabilities (CSCup22487)

The remote Cisco IOS XE device is missing a vendor-supplied security patch, and its web user interface is configured to use HTTPS. It is, therefore, affected by the following vulnerabilities in the bundled OpenSSL library : - An error exists in the ssl3readbytes function that could allow data to ...

Cisco NX-OS OpenSSL Multiple Vulnerabilities

The remote Cisco device is running a version of NX-OS software that is affected by multiple vulnerabilities in the bundled OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note this iss...

JDK: J9 JVM allows code to invoke non-public interface methods

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...

JDK: J9 JVM allows code to invoke non-public interface methods

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...

JDK: J9 JVM allows code to invoke non-public interface methods

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...

Microsoft Internet Explorer XSS Filter Bypass Vulnerability (CNVD-2015-08027)

Microsoft Internet Explorer IE is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. A security feature bypass vulnerability exists in Microsoft IE that originates from the program failing to properly enforce...

Data Injection Vulnerability in moped Rubygem

A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object...

Data Injection Vulnerability in bson Rubygem

A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object...

EMC Autostart data injection

Commands injection is possible...

Mandriva Linux Security Advisory : openssl (MDVSA-2015:062)

Multiple vulnerabilities has been discovered and corrected in openssl : Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service use-after-free and...

Debian DLA-108-1 : nfs-utils security update

In the past, rpc.statd posted SMNOTIFY requests using the same socket it used for sending downcalls to the kernel. To receive replies from remote hosts, the socket was bound to INADDRANY. To prevent unwanted data injection, bind this socket to the loopback address. NOTE: Tenable Network Security...

DLA-108-1 nfs-utils - security update

Bulletin has no description...

F5 Networks BIG-IP : OpenSSL vulnerability (K15328)

Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service use-after-free and parsing error via an SSL connection in a multithreaded environment...

Discuz！的addcslashes对序列化字符串处理不当造成数据注入

简要描述： 首先声明一点，这个漏洞2014-09-10在“腾讯安全应急响应中心”发过，账号现已放弃，对于腾讯不想多说什么 问题描述： DiscuzX3.2及以下 可盗取管理员、用户信息，蠕虫攻击等 详细说明： source\class\discuz\discuzdatabase.php public static function quote$str, $noarray = false if isstring$str return ''' . addcslashes$str, "\n\r\'"\032" . ''';...

Apache Tomcat 8.0.x < 8.0.11 Multiple OpenSSL Vulnerabilities

According to its self-reported version number, the Apache Tomcat server running on the remote host is 8.0.x prior to 8.0.11. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - An error exists in the function 'ssl3readbytes' that could allow data to be...

Data Injection Vulnerability in Active Record

The createwith functionality in Active Record was implemented incorrectly and completely bypasses the strong parameters protection. Applications which pass user-controlled values to createwith could allow attackers to set arbitrary attributes on models...

HP Version Control Agent (VCA) < 7.3.3 Multiple SSL Vulnerabilities

The RPM installation of HP Version Control Agent VCA on the remote Linux host is a version prior to 7.3.3. It is, therefore, affected by multiple vulnerabilities in the bundled version of SSL : - An error exists in the 'ssl3readbytes' function that permits data to be injected into other sessions ...