Open-Xchange: OX (Guard): Stored Cross-Site Scripting via Incoming Email

Summary "OX Guard" introduces a Stored Cross-Site Scripting XSS vulnerability to the frontend. HTML/JS code can be injected into the frontend through an incoming email. Injected code will be executed = become part of the DOM the moment the victim opens the email. The vulnerability allows for...

[SECURITY] Fedora 24 Update: libgcrypt-1.6.5-1.fc24

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

Open-Xchange OX Guard Security Bypass Vulnerability

Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A security bypass vulnerability exists in versions 2.0 and 2.2.0 of Open-Xchange OX Guard, which can be exploited by attackers to bypass security restrictions and perform unauthorized...

Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection

Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...

Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection

Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...

Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection

Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...

Open-Xchange Guard Information Disclosure Vulnerability

Open-Xchange Guard OX Guard is a suite of security protection software for e-mail and files from Open-Xchange, Inc. in the United States. An information disclosure vulnerability exists in OX Guard version 2.4.0, which originates when the program returns a different error code. A remote attacker...

search-guard in Elasticsearch 2.3 use-vulnerability warning-the black bar safety net

Reference content： http://kibana.logstash.es/content/elasticsearch/auth/searchguard-2.html https://groups.google.com/forum/! forum/search-guard https://github.com/floragunncom/search-guard This article is based on the following software versions, different versions may have slightly differences:...

Open-Xchange App Suite 7.8.1 Information Disclosure

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 45328 Bug ID Vulnerability type: Information Exposure CWE-200 Vulnerable version: 7.8.1 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev43,...

lib32-glibc: denial of service

clntudpcall allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack frame overflow denial of...

Microsoft Internet Explorer Security Feature Bypass Vulnerability

Microsoft Internet Explorer IE is a Web browser developed by the American company Microsoft and is the default browser that comes with the Windows operating system. A security feature bypass vulnerability exists in the User Mode Code Integrity UMCI component of Device Guard in Microsof IE version...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

Security feature bypass

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-0188

The User Mode Code Integrity UMCI implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."...

CVE-2016-0188

CVE-2016-0188 affects Internet Explorer 11 via the Device Guard UMCI component, enabling a remote attacker to bypass code-signing protections and run unsigned code. The vulnerability stems from UMCI policy validation weaknesses in IE’s User Mode Code Integrity, allowing code that should be blocke...

KLA10806 Multiple vulnerabilities in Microsoft Internet Explorer and Edge

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper memory...

ThreatCert Privacy Leak Guard - Certificates or keys found, Corrupted files, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application ThreatCert Privacy Leak Guard published at the 'play' market has multiple vulnerabilities...

Gnu Privacy Guard - Dangerous filesystem permissions, Exported ContentProvider, Runtime privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application Gnu Privacy Guard published at the 'play' market has multiple vulnerabilities...

Backup Guard < 1.0.3 - Authenticated Arbitrary File Upload

The plugin allowed any authenticated user to call the AJAX actions, including the one to import backups which could lead to arbitrary file upload...