DEBIAN-CVE-2016-4956

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service interleaved-mode transition and time change via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548...

CVE-2016-1196

Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776...

CVE-2016-1197

Cross-site scripting XSS vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775...

CVE-2016-1195

Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL...

Cybozu Garoon Directory Traversal Vulnerability (CNVD-2016-03722)

Cybozu Garoon is a portal-type OA office system of Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin boards, document management, and other functions, and supports free switching among three languages Chinese, Japanese, and English. A directory traversal...

CVE-2016-4782

Lenovo SHAREit before 3.5.98ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."...

PT-2016-4081 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.4.2 Description: The issue allows local users to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This occurs when a crafted application does not supply a key, related ...

Elasticsearch Kibana Cross-Site Request Forgery Vulnerability

Elasticsearch Kibana formerly known as elasticsearch-dashboard is a suite of open-source, browser-based analytics and search Elasticsearch dashboard tools from the Dutch company Elasticsearch. A cross-site request forgery vulnerability exists in Elasticsearch Kibana versions prior to 4.1.3 and...

DEBIAN-CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

DEBIAN-CVE-2015-5733

Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...

DEBIAN-CVE-2015-5732

Cross-site scripting XSS vulnerability in the form function in the WPNavMenuWidget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title...

Linux kernel IPC object implementation race condition vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A contention condition vulnerability exists in the IPC object implementation of Linux kernel 4.2.3 and earlier. As the 'ipcaddid' function adds incompletely initialized object...

Linux kernel buffer overflow vulnerability (CNVD-2015-06888)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A security vulnerability in the 'sctpinit' function in the net/sctp/protocol.c file in Linux kernel versions 4.2.2 and earlier stems from the presence of a failure to correctl...

PT-2015-6831 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.2.3 Description: The issue is related to an incorrect sequence of protocol-initialization steps in the sctp init function, which can cause a denial of service, resulting in a panic or memory corruption. This c...

Zend Framework XML External Entity Injection Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An XML external entity injection vulnerability exists in ZF versions 2.4.2 and earlier and 1.12.13 and earlier. An...

Best Practical Solutions Request Tracker Cross-Site Scripting Vulnerability

Best Practical Solutions Request Tracker RT is an enterprise-grade, open source issue tracking system from Best Practical Solutions in the United States. The system has Bug tracking , customer service , customized workflow and other features . A cross-site scripting vulnerability exists in Best...

Sierra Wireless ALEOS Administrator Access Gain Vulnerability

Founded in 1993 in Canada, Sierra Wireless provides hardware, software, and services in the wireless marketplace, delivering innovative, reliable, and high-performance solutions to its customers.ALEOS is the application framework... A security vulnerability in Sierra Wireless ALEOS versions prior...

WordPress Cross-Site Scripting Vulnerability (CNVD-2015-05124)

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the wp-includes/kses.php and wp-includes/shortcodes.php script...

Fastspot BigTree 'admin.php' Script HTML Injection Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An HTML injection vulnerability exists in Fastspot BigTree CMS versions prior to 4.2.3, which stems from the program failing to adequately filter user-submitted input. When...

EMC Document Sciences xPression SQL Injection Vulnerability

EMC Document Sciences is a customer communications management solution. A SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression versions 4.2, 4.5 SP1 can be exploited by remote attackers to access or modify information on an affected system by executing SQL comman...