UBUNTU-CVE-2016-1710

The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site...

Google Chrome DoS

The Google Chrome browser contains a vulnerability related to the use of memory after its release use-after-free error in the content/renderer/rendererwebcolorchooserimpl.h file. Exploiting this vulnerability allows malicious actors to cause service failures or otherwise affect the system by usin...

Android Server Replacement

The vulnerability of the caching function in the TrustManagerImpl class TrustManagerImpl.java of the Conscrypt component in the Android operating system is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor to replace servers by accessing...

Google Chrome Pepper plugin same-origin policy bypass vulnerability

Google Chrome is a web browser developed by Google, and Pepper is a player plug-in for playing Flash videos. Versions of the Pepper plugin prior to Google Chrome 49.0.2623.75 have the file content/renderer/pepper/ppbflashmessageloopimpl.cc in the file 'PPBFlashMessageLoop A security vulnerability...

OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883...

dashbuilder: XXE/SSRF vulnerability

A flaw was found in the dashbuilder import facility: the DocumentBuilders instantiated in org.jboss.dashboard.export.ImportManagerImpl did not disable external entities. This could allow an attacker to perform a variety of XML External Entity XXE and Server-Side Request Forgery SSRF attacks...

PT-2015-1792

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 40.0 Firefox ESR versions prior to 38.2 Firefox OS versions prior to 2.2 Description The issue is related to the nsTArray Impl class and might allow remote attackers to cause a denial of service or possibly ha...

OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853)

An information leak flaw was found in the JMX component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions...

UBUNTU-CVE-2015-1237

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/renderframeimpl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages...

UBUNTU-CVE-2014-1727

Use-after-free vulnerability in content/renderer/rendererwebcolorchooserimpl.h in Google Chrome before 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms...

PT-2013-6022

Name of the Vulnerable Software and Affected Versions OpenStack Ceilometer versions 2013.2 and earlier Description The issue allows local users to obtain sensitive information, specifically the DB2 or MongoDB password, by reading the log file when the logging level is set to INFO. This occurs...

RichFaces: Remote code execution due to insecure deserialization

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBo...

OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than...

OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX...

OpenJDK: RMIConnectionImpl insufficient access control checks (JMX, 7198296)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than...

OpenJDK: RMIConnectionImpl information disclosure (JMX, 7169888)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, related to JMX...

PT-2016-1343

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 49.0.2623.75 Opera versions prior to 49.0.2623.75 Description The issue is related to the PPB Flash MessageLoop Impl::InternalRun function in the Pepper plugin, which mishandles nested message loops. This allows...

openSUSE Security Update : xerces-j2 (xerces-j2-1233)

The xerces-j2 package was vulnerable to various bugs while parsing XML.CVE-2009-2625 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update xerces-j2-1233. The text...

CVE-2009-2475

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to 1 LayoutQueue, 2 Cursor.predefined, 3...

CVE-2008-0179: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format...