PT-2015-7697

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway versions prior to 10.1 Build 133.9 Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway versions 10.5 prior to Build 58.11 Citrix NetScaler...

CVE-2015-7996: Exposure of Sensitive Information to an Unauthorized Actor

The Nitro API in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allow attackers to obtain credentials via the browser cach...

CVE-2015-7998: Exposure of Sensitive Information to an Unauthorized Actor

The administration UI in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allows attackers to obtain sensitive information v...

CVE-2015-7997: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allow...

PT-2015-7696

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway versions prior to 10.1 Build 133.9 Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway versions 10.5 prior to Build 58.11 Citrix NetScaler...

CVE-2015-6364

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

Design/Logic Flaw

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

CVE-2015-6364

Cisco Videoscape Distribution Suite Service Manager REST API Information Disclosure (CVE-2015-6364) affects Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager. The root cause is improper validation of HTTP requests to the REST API, allowing an unau...

CVE-2015-6364

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

PT-2015-7205

Name of the Vulnerable Software and Affected Versions Cisco Content Delivery System Manager Software version 3.2 Description The issue allows remote attackers to obtain sensitive information via crafted URLs in REST API requests. Recommendations For Cisco Content Delivery System Manager Software...

CVE-2015-6364: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960...

x86: CPU lockup during exception delivery

ISSUE DESCRIPTION When a benign exception occurs while delivering another benign exception, it is architecturally specified that these would be delivered sequentially. There are, however, cases where this results in an infinite loop inside the CPU, which in the virtualized case can be broken only...

iBackDoor: High-Risk Code Hits iOS Apps

Introduction FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store. The affected versions of this library embedded functionality in iOS apps that used the library to display...

Shopify: Arbitrary read on s3://shopify-delivery-app-storage/files

Short ==== An attacker is able to read arbitrary files from the delivery app storage if the bucket key is known to him. Vector ==== 1 The victim uploads a.png to a product his shop located at https://myhackeronestore.myshopify.com. 1a The file is stored at...

CVE-2015-7372

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...

CVE-2015-7372: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the layerstyle parameter...

Shopify: Arbitrary write on s3://shopify-delivery-app-storage/files

Short ==== The policy used to upload files via the Delivery app is too generic which results in an arbitrary write and replace of files in the files/ directory. Disclaimer: While I was unable to create a second store to fully test this I can't create new development stores right now, support is...

WinRAR SFX Remote Code Execution Vulnerability

WinRAR is a very popular compression/decompression tool. A remote code execution security vulnerability exists in WInRAR SFX v5.21, Text and Icon feature of the Text to display in SFX window module. A remote attacker exploiting this vulnerability with a zip archive with a malicious load can...

Threat Outbreak Alert RuleID18331: Email Messages Distributing Malicious Software on September 29, 2015

Medium Alert ID: 41261 First Published: 2015 September 29 16:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18331 may contain the following files: Name ...

The vulnerability of the Microsoft SharePoint Foundation electronic document management system allows a hacker to inject arbitrary web or HTML code.

The vulnerability of the Microsoft SharePoint Foundation e-mail delivery system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary web or HTML code remotely...