CVE-2016-6814

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization an...

CVE-2016-6774

An information disclosure vulnerability in Package Manager could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate because it first requires compromising a privileged process. Product:...

TFS application pool and Certreq.exe crash after security update 3081320 is installed in Windows Server 2012 R2

TFS application pool and Certreq.exe crash after security update 3081320 is installed in Windows Server 2012 R2 This article describes an issue that occurs after you install security update 3081320 in Windows Server 2012 R2. You can fix this issue by using the update in this article. Before you...

[SECURITY] Fedora 23 Update: lxc-2.0.6-2.fc23

Linux Resource Containers provide process and resource isolation without the overhead of full virtualization...

[SECURITY] Fedora 24 Update: lxc-2.0.6-2.fc24

Linux Resource Containers provide process and resource isolation without the overhead of full virtualization...

[SECURITY] Fedora 25 Update: lxc-2.0.6-2.fc25

Linux Resource Containers provide process and resource isolation without the overhead of full virtualization...

SA136 : OpenSSH Vulnerabilities

SUMMARY Blue Coat products using affected versions of OpenSSH are susceptible to several vulnerabilities. A remote attacker, with access to the management interface, can exploit these vulnerabilities to enumerate existing user accounts and cause denial of service through excessive CPU consumption...

chromium-browser: use of unvalidated data in pdfium

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page...

CVE-2016-5217

The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page...

Downloads Resources over HTTP

Overview Affected versions of mystem-wrapper insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code executi...

FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region

In 2012, a suspected Iranian hacker group called the “Cutting Sword of Justice” used malware known as Shamoon – or Disttrack. In mid-November, Mandiant, a FireEye company, responded to the first Shamoon 2.0 incident against an organization located in the Gulf states. Since then, Mandiant has...

CVE-2016-6710

An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to bypass operating system protections that isolate application data from other...

UBUNTU-CVE-2016-6710

An information disclosure vulnerability in the download manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to bypass operating system protections that isolate application data from other...

OpenStack Heat Information Disclosure Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA and Rackspace, Inc. in the United States. An information disclosure vulnerability exists in OpenStack Heat, which is exploited by an authenticated attacker to obtain information...

Command Execution Vulnerability in China_gate_edit_op.php, the Security Isolation Gateway of Beijing Yuanwei Software Co.

Beijing Yuanwei Software Co., Ltd. security isolation gateway is a multi-network security isolation system based on terminal virtualization technology and network virtualization technology. A command execution vulnerability exists in chinagateeditop.php, the security isolation gateway of Beijing...

Command Execution Vulnerability in China_user_add_op.php, the Security Isolation Gateway of Beijing Yuanwei Software Co.

Beijing Yuanwei Software Co., Ltd. security isolation gateway is a multi-network security isolation system based on terminal virtualization technology and network virtualization technology. A command execution vulnerability exists in chinauseraddop.php, the security isolation gateway of Beijing...

Command Execution Vulnerability in the Security Isolation Gateway general_gate_add_op.php at Beijing Yuanwei Software Co.

Beijing Yuanwei Software Co., Ltd. security isolation gateway is a multi-network security isolation system based on terminal virtualization technology and network virtualization technology. A command execution vulnerability exists in generalgateaddop.php, the security isolation gateway of Beijing...

Command Execution Vulnerability in the Security Isolation Gateway china_gate_add_op.php at Beijing Yuanwei Software Co.

Beijing Yuanwei Software Co., Ltd. security isolation gateway is a multi-network security isolation system based on terminal virtualization technology and network virtualization technology. A command execution vulnerability exists in chinagateaddop.php, the security isolation gateway of Beijing...

Multiple Command Execution Vulnerabilities in the Security Isolation Gateway of Beijing Yuanwei Software Co.

Beijing Yuanwei Software Co., Ltd. security isolation gateway is a multi-network security isolation system based on terminal virtualization technology and network virtualization technology. Multiple command execution vulnerabilities exist in the security isolation gateway of Beijing Yuanwei...

Sauter NovaWeb Web HMI Authentication Bypass Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified an authentication bypass vulnerability in Sauter’s NovaWeb web HMI application. Sauter has not produced a mitigation for this vulnerability. This product was discontinued in 2013 and is no longer supported. This vulnerability could be...