CVE-2016-6410

CVE-2016-6410 relates to Cisco IOS/IOS XE CAF with the IOx feature enabled, where an authenticated remote attacker could read arbitrary files via unspecified vectors. The root cause is cited as insufficient input validation in CAF. Cisco has released software updates addressing this vulnerability...

CVE-2016-6412

The CVE-2016-6412 entry describes a vulnerability in Cisco IOS/IOS XE’s Application-hosting Framework (CAF) when the IOx feature set is enabled. The issue arises from insufficient input validation in CAF, allowing a remote attacker to induce a CAF user to download an attacker-controlled file by s...

Cisco IOS and IOS XE Software Application-Hosting Framework HTTP Header Injection Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An HTTP header injection vulnerability exists in the Application-Hosting Framework component in Cisco IOS version 15.61T1 and IOS XE Software. When the Iox feature setting is...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An unauthorized file access vulnerability exists in the Application-Hosting Framework component of Cisco IOS and IOS XE Software. When the Iox feature setting is enabled, a remote...

Canoas Web Hosting Administration Page Bypass Vulnerability

A security vulnerability exists in the Canoas web hosting administration page. Due to a failure to filter the Login and Senha parameters in the admin/login.php page. This allows an attacker to bypass login restrictions and perform unauthorized operations...

Cisco IOS Software Cisco Application-Hosting Framework HTTP Header Injection Vulnerability (cisco-sa-20160921-caf1)

A vulnerability in the Cisco Application-hosting Framework CAF component for Cisco IOS Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a CAF user to download a file controlled by the attacker. SPDX-FileCopyrightText: 2016 Greenbone AG Some text...

Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability

A vulnerability in the Cisco application-hosting framework CAF for Cisco IOS and IOS XE Software with the IOx feature set could allow an authenticated, remote attacker to read arbitrary files on a targeted system. The vulnerability is due to insufficient input validation by the affected framework...

Cisco Application-Hosting Framework HTTP Header Injection Vulnerability

A vulnerability in the Cisco Application-hosting Framework CAF component for Cisco IOS and IOS XE Software with the IOx feature set could allow an unauthenticated, remote attacker to cause a CAF user to download a file controlled by the attacker. The vulnerability is due to insufficient input...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.50.3-i586-1slack14.2.txz: Upgraded. Fixed heap overflows in four libcurl functions: curlescape,...

Legal Robot: AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobot

Good day, I hope it treats you kindly : Legal Robot looks to use AWS hosting for your website. Description of issue: ===================== The Amazon Bucket s3://legalrobot has been configured to allow Public users access to browse all files on the server. This is a risk as described as it allows...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-45.3.0-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. F...

[slackware-security] Linux kernel

New Linux kernel packages are available for Slackware 14.2 and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.19/: Upgraded. A flaw was found in the implementation of the Linux kernels handling of networking challenge ack where...

Drupal hosting module access rights bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. hosting is one of the core modules of the Aegir hosting system. An access privilege bypass vulnerability exists in Drupal hosting module versions 7.x-3.x prior to 7.x-3.7. An attacker...

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046

The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/curl-7.50.1-i586-1slack14.2.txz: Upgraded. This release fixes security issues: TLS: switch off SSL sessi...

Unable to Communicate With Hypervisor When Using XenDesktop Setup Wizard

Unable to Communicate with Hypervisor when using XenDesktop Setup Wizard. Logs display, "object reference not set to instance of an object" When running XenDesktop Setup Wizard, error states, "cannot connect to hypervisor" Logs shows an error when checking a particular hosting unit. Checked Host...

Multiple Vulnerabilities in Easy Hosting Control Panel

Easy Hosting Control Panel EHCP is an open source site management panel. There are arbitrary file upload vulnerabilities and information leakage vulnerabilities in EHCP, which can be exploited by attackers to upload and run arbitrary code in the web server process to obtain sensitive information...

Kickass Torrents — Domain Names Seized! Owner Arrested! Website Goes Down!

The federal authorities have finally arrested the alleged mastermind behind the world's largest and most notorious BitTorrent distribution site Kickass Torrents KAT, the US Justice Department announced on Wednesday. After The Pirate Bay had suffered copyright infringement hardship, Kickass Torren...

Vulnerabilities in PHP software allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The use of this component in ext/spl/spldllist.c after its release allows attackers to trigger service failures or exert other effects on the system, by using specially crafted iterators for applications in certain web hosting environments...

Dropbox: XSS, Unvalidated redirects & phishing website hosting on dropbox servers

The report points out that Dropbox allows uploading and hosting HTML; this enables spam and phishing risks as well as XSS on dropboxusercontent.com. We continuously monitor our service for abusive use and take down such content; additionally, we are continuously improving our protections in this...