4138 matches found
About the security content of Safari 10.1
About the security content of Safari 10.1 This document describes the security content of Safari 10.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Cybozu KUNAI for Android information management vulnerability
Overview Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issu...
Privilege escalation
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...
Events and disabled form fields
I've been working on the web since I was a small child all the way through to the haggard old man I am to day. However, the web still continues to surprise me. Turns out, mouse events don't fire when the pointer is over disabled form elements, except in Firefox. Serious? Serious. Give it a go. Mo...
BINOM3 Electric Power Quality Meter Hard-Coded Vulnerability
BINOM3 Electric Power Quality Meter is an electrical power quality monitor for SCADA systems from the Russian company BINOM3. A hard-coded vulnerability exists in BINOM3 Electric Power Quality Meter, where users do not have permission to change their passwords...
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1010 This issue affects OpenSSH if privilege separation is disabled config option UsePrivilegeSeparation=no. While privilege separation is enabled by default, it is documented as a hardening option, and therefore disabling it shoul...
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free (MS13-021)
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free MS13-021 var oElement = document.getElementById"ruby"; var oElement = oElement.parentNode.removeChildoElement; document.write""; document.documentElement.offsetTop; setTimeout"location.reload", 100; !-- Time-lin...
Stored Cross-Site Scripting Vulnerability in SS-Panel
SS-Panel is a front-end program that works with Shadowsocks-Manyuser. A stored cross-site scripting vulnerability exists in SS-Panel version 3.3.9. Since HttpOnly is not enabled by default, an attacker can exploit the vulnerability to obtain an administrator cookie and use the cookie to log in to...
XenMobile user shows as "Anonymous" in XenMobile Admin Console
Within the XenMobile console, under the user column, few users started showning as anonymous. In zdm.logs we might see:User '[email protected]' not found or is disabled. Switching to anonymous mode...
Extreme ExtremeXOS OpenSSL Vulnerability (VN-2016-002)
Extreme ExtremeXOS is prone to an OpenSSL vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:extremenetworks:exos"; i...
VulnCheck KEV: CVE-2016-8870
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting...
Account creation vulnerability in Joomla!
Joomla! is a PHP-based open source content management system CMS. Can be used to build commercial Web sites , personal blogs , information management systems , Web services , etc. , but also for secondary development to expand the scope of use . An account creation vulnerability exists in Joomla!...
MGASA-2016-0359 Updated java-1.8.0-openjdk packages fix security vulnerability
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions CVE-2016-5582...
UBUNTU-CVE-2016-5288
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox 49.0.2...
[20161001] - Core - Account Creation
Inadequate checks allows for users to register on a site when registration has been disabled...
Atlassian Confluence Server 5.8.x < 5.8.6 Multiple Vulnerabilities
Binary data 9645.prm...
Debian DLA-598-1 : suckless-tools security update
It was discovered that the slock screen locking tool would segfault when the user's account had been disabled. slock called crypt3 and used the return value for strcmp3 without checking to see if the return value of crypt3 was a NULL pointer. If the hash returned by getspnam-sppwdp was invalid,...
Error:"Unable to launch your app....Cannot connect to the Citrix XenApp server. SSL Error 4... The server rejected the connection."
Error: "Unable to launch your application. Contact your help desk with the following information: Cannot connect to the Citrix XenApp server. SSL Error 4: Attempted to connect using the TLS V1.0 | SSL V3.0 protocols. The server rejected the connection" whentrying to launch apps when SSL v3 and TL...
Solaris 10 (x86) : 152101-62 (deprecated)
JavaSE 8x86: update 162 patch equivalent to JDK 8u162, 64bit. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 152101 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabl...
Microsoft Edge and Internet Explorer CVE-2016-3276 Spoofing Vulnerability
Description Microsoft Edge and Internet Explorer are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies Affected...