Cassandra: remote code execution via unauthenticated JMX/RMI interface

It was found that Apache Cassandra bound an unauthenticated JMX/RMI interface to all network interfaces. A remote attacker able to access the RMI, an API for the transport and remote execution of serialized Java, could use this flaw to execute arbitrary code as the user running Cassandra...

Mac OS X < 10.11 Multiple Vulnerabilities

Binary data 8982.prm...

CVE-2015-4846

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from t...

CVE-2015-4846: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to SQL Extensions. NOTE: the previous information is from t...

Oracle E-Business Multiple Vulnerabilities (October 2015 CPU)

The version of Oracle E-Business installed on the remote host is missing the October 2015 Oracle Critical Patch Update CPU. It is, therefore, affected by vulnerabilities in the following components : - An unspecified flaw exists in the Online Patching subcomponent in the Applications DBA. An...

VMware vCenter Server JMX RMI Service Vulnerability

VMware vCenter Server is a set of server and virtualization management software from VMware. A security vulnerability exists in the JMX RMI service of VMware vCenter Server. A remote attacker can exploit this vulnerability to execute arbitrary code via the RMI protocol...

CVE-2015-5780

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

Design/Logic Flaw

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

CVE-2015-5780

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

CVE-2015-5780

The CVE-2015-5780 entry concerns Safari before v9, where the Safari Extensions implementation allowed a validated, user-installed extension to be replaced on disk without prompting the user. Root cause: extension replacement validation/UX flow did not require user confirmation. Impact stated in s...

PT-2015-2265

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9 Description The issue is related to the Safari Extensions implementation, which does not require user confirmation before replacing an installed extension. This has an unspecified impact and attack vectors. The...

CVE-2015-5780: Improper Input Validation

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

Oracle: Security Advisory (ELSA-2014-1652)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

mbedTLS/PolarSSL -- DoS and possible remote code execution

ARM Limited reports: When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the sessio...

Apple Safari Extension Replacement Vulnerability

Apple Safari is a WEB browser. A security vulnerability exists in Apple Safari that allows remote attackers to exploit a vulnerability to trick users into parsing, replaceable extensions...

Mac OS X : Apple Safari < 9.0 Multiple Vulnerabilities

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.0. It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - Safari Downloads - Safari Extensions - Safari Safe Browsing - WebKit - WebKit CSS - WebKit JavaScript Bindings - WebKi...

Design/Logic Flaw

PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted enterprise app...

CVE-2015-5837

Apple iOS PluginKit in versions before 9 allows bypassing the intended app-trust check to install arbitrary extensions via a crafted enterprise app. The root cause is/are the insufficient validation checks during extension installation, enabling an enterprise app to push extensions before user tr...

PT-2015-2091

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 9 Description The issue exists due to insufficient input validation in the PluginKit component of the iOS operating system. This allows a remote attacker to bypass the app review process and install arbitrary...

CVE-2015-5837: Improper Input Validation

PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted enterprise app...