Server: Content-Spoofing in "dav" app

The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

Cisco TelePresence Endpoints Local Command Injection Vulnerability

Cisco TelePresence Endpoints is a new system technology that combines a series of technological breakthroughs and integrated technologies from Cisco in the fields of intelligent IP networks, unified communications, ultra-high-definition IP video up to click here to add a picture to illustrate the...

Cisco TelePresence Endpoints Local Command Injection Vulnerability

Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated, local attacker to execute a local shell command injection. The vulnerability is due to incomplete input sanitization of some commands. An attacker could exploit this...

Polycom HDX Video End Points XML External Entity Denial of Service Vulnerability

Polycom HDX Video End Points video conferencing system. A denial of service vulnerability exists in Polycom HDX Video End Points. An attacker could exploit this vulnerability to cause a denial of service condition...

Unspecified Cross-Site Scripting Vulnerability in Polycom HDX Video End Points

Polycom HDX Video End Points video conferencing system. An unspecified cross-site scripting vulnerability exists in Polycom HDX Video End Points. The vulnerability can be exploited to execute arbitrary HTML and script code in the browsers of trusted users in the context of an affected site, steal...

jenkins: Remote code execution through remote API (SECURITY-247)

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando...

Algolia: Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.

Summary ------------- Invited team members or collaborators on https://www.algolia.com/manage/applications/APPID/team can use the /1/admin/ REST endpoints to leak some information, which they should not be able to have access to. Steps to reproduce -------------- 1. Invite a new team member to yo...

Antivirus firm Avast to Buy its rival AVG for $1.3 Billion

Breaking News for Today: Antivirus company Avast Software is planning to acquire Dutch rival AVG Technologies for $1.3 Billion in cash. Avast announced today that it would buy Amsterdam-based AVG Technologies for $25 per share in an all-cash transaction valued at $1.3 Billion in an aim to expand...

Cisco Configuration Assistant Cloud Network Automation Provisioner Information Disclosure Vulnerability

Cisco Configuration Assistant CCA is a suite of solutions from Cisco that simplifies the configuration, deployment, and management of Cisco intelligent business communications systems.Cisco Cloud Network Automation Provisioner CNAP is one of the cloud network Automation Provisioning Software. An...

Cisco Configuration Assistant Request Processing Unauthorized Access Vulnerability

A vulnerability in Cisco Configuration Assistant CCA could allow an unauthenticated, remote attacker to access sensitive file systems and administrative endpoints without user authentication. The vulnerability is due to lack of controller mechanisms and input validation checks. An attacker could...

PT-2017-7998 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite 5 affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API...

CVE-2016-3723

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints...

CloudBees Jenkins CI and Jenkins LTS Information Disclosure Vulnerability

CloudBees Jenkins CI formerly known as Hudson Labs is a Java-based continuous integration tool from CloudBees, Inc. It is mainly used to monitor ongoing software releases/testing projects and a number of timed tasks.LTS Long-Term Support is a long-supported version of CloudBees Jenkins CI is a...

Updated jenkins-remoting packages fix CVE-2016-0792

Updated jenkins-remoting packages fix security vulnerability: Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. SECURITY-247 ...

Linux kernel denial of service vulnerability (CNVD-2016-02791)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the 'mctu232msrtostate' function in the drivers/usb/serial/mctu232.c file in Linux kernel versions prior to 4.5.1. An attacker coul...

Linux kernel denial of service vulnerability (CNVD-2016-02789)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the 'acmprobe' function in the drivers/usb/class/cdc-acm.c file in Linux kernel versions prior to 4.5.1. The vulnerability can be...

DEBIAN-CVE-2016-3136

The mctu232msrtostate function in drivers/usb/serial/mctu232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted USB device without two interrupt-in endpoint descriptors...

PT-2016-5052 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.5.2 Description: The issue allows physically proximate attackers to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This is achieved by using a crafted endpoints value...

UBUNTU-CVE-2016-2188

The iowarriorprobe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted endpoints value in a USB device descriptor...

UBUNTU-CVE-2016-3138

The acmprobe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a USB device without both a control and a data endpoint descriptor...