Mass General Hospital Confirms Third-Party Breach

A breach at Massachusetts General Hospital has potentially compromised the information of roughly 4,300 dental patients, the hospital warned Wednesday. MGH was quick to point out that the data leaked wasn’t stored or maintained on its systems but those of a third-party vendor that assists the...

Security Advisory - Data Leak Vulnerability in the FusionCompute

The FusionCompute is a cloud operating system OS. It virtualizes computing, storage, and network resources, and implements centralized management and scheduling of the virtual resources through a unified interface. Huawei FusionCompute has sensitive data leak vulnerability. An attacker can log in...

CVE-2016-2538

Multiple integer overflows in the USB Net device emulator hw/usb/dev-network.c in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service QEMU process crash or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the 1...

CVE-2016-5244

A vulnerability was found in the Linux kernel in function rdsincinfocopy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. This can leak data previously at the flags location to userspace...

Google Chrome createCustomType Function Information Disclosure Vulnerability

Google Chrome is a web browsing tool developed by Google. In Google Chrome versions prior to 51.0.2704.79, the extensions/renderer/resources/binding.js/createCustomType function does not validate the module type, an information disclosure vulnerability exists, which can be exploited by remote...

New Relic: JIRA account misconfig causes internal info leak

This issue was originally reported via email [email protected] Hello, In preparation for security conference I'm doing a research of popular task tracking systems / project management software and how they affect company's IT security. During investigation I've found several critical...

libxml2: Heap-based buffer overflow in xmlGROW

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information...

Linux Kernel (Ubuntu 14.04.3) - perf_event_open() Can Race with execve() (Access etcshadow)

Linux Kernel Ubuntu 14.04.3 - perfeventopen Can Race with execve Access etcshadow Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=807 A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. perfeventopen associates with a task as...

Linux Kernel (Ubuntu 14.04.3) - 'perf_event_open()' Can Race with execve() (Access /etc/

Exploit for linux platform in category local exploits Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=807 A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. perfeventopen associates with a task as follows:...

chromium-browser: potential leak of sensitive information to malicious extensions

The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension...

SAP NetWeaver AS JAVA UDDI Component XML External Entity Reference Vulnerability

SAP NetWeaver is an integrated, service-oriented application platform that provides a development and runtime environment for SAP applications.SAP NetWeaver AS Java is an application server that runs in NetWeaver and is based on the Java programming language. An XML external entity reference...

CactiEZ Chinese version has information leakage vulnerability

CactiEZ Chinese version is a server and network monitoring tool. An information disclosure vulnerability exists in the cactiez.sql and log/cacti.log pages of the Chinese version of CactiEZ. An attacker can exploit the vulnerability to obtain sensitive information...

openstack-nova: Host data leak through resize/migration

An information-exposure flaw was found in the OpenStack Compute nova resize and migrate functionality. An authenticated user could write a malicious qcow header to an ephemeral or root disk, referencing a block device as a backing file. With a subsequent resize or migration, file system content o...

UBUNTU-CVE-2016-1637

The SkATan2255 function in effects/gradients/SkSweepGradient.cpp in Skia, as used in Google Chrome before 49.0.2623.75, mishandles arctangent calculations, which allows remote attackers to obtain sensitive information via a crafted web site...

Fedora 22 : bugzilla-4.4.11-1.fc22 (2015-caf3f74321)

The following security issues have been discovered in Bugzilla: Unfiltered HTML injected into a dependency graph could be used to create a cross-site scripting attack. Some web browsers incorrectly parse CSV files as valid JavaScript code which could lead to data leak. This updates fixes these...

SQL Injection Vulnerability in 'infoid' Parameter of Wave Software Government System

Wave software government system is an industry informatization application system built on the basis of cloud computing and big data. A SQL injection vulnerability exists in the parameters of the WaveSoft Government System. The lack of filtering of the 'infoid' parameter allows an attacker to...

ALPINE-CVE-2015-8629

The xdrnullstring function in lib/kadm5/kadmrpcxdr.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service...

CVE-2016-1619

CVE-2016-1619 refers to multiple integer overflows in the PDFium crypto/codec path (fxcodec/fx_codec_jpx_opj.cpp: sycc422_to_rgb and sycc444_to_rgb) used by Google Chrome prior to 48.0.2564.82. The vulnerability enables a remote attacker to trigger a denial of service via a crafted PDF document, ...

openstack-nova: Unprivileged API user can access host data using instance snapshot

A flaw was discovered in the OpenStack Compute nova snapshot feature when using the libvirt driver. A compute user could overwrite an attached instance disk with a malicious header specifying a backing file, and then request a snapshot, causing a file from the compute host to be leaked. This flaw...

191 Million US Voters' Personal Info Exposed by Misconfigured Database

BREAKING: A misconfigured database has resulted in the exposure of around 191 Million voter records including voters' full names, their home addresses, unique voter IDs, date of births and phone numbers. The database was discovered on December 20th by Chris Vickery, a white hat hacker, who was ab...