FreeBSD : FreeBSD -- ktrace kernel memory disclosure (6e04048b-6007-11e6-a6c3-14dae9d210b8)

Due to an overlooked merge to -STABLE branches, the size for page fault kernel trace entries was set incorrectly. Impact : A user who can enable kernel process tracing could end up reading the contents of kernel memory. Such memory might contain sensitive information, such as portions of the file...

Error Windows API: There is not enough space on the disk. Error number 0xE00000070

When trying to merge a vDisk, the following error is seen: The error is not seen when adding a vDisk or a new vDisk version to the store, just when merging the vDisk versions. Windows Explorer shows a sufficient amount of free space for the merge process in the vDisk store and running the...

DEBIAN-CVE-2016-3993

Off-by-one error in the imlibMergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service out-of-bounds read and application crash via crafted coordinates...

hp.com XSS vulnerability

Vulnerable URL: http://www.hp.com/sbso/solutions/real/assets/mayfieldmailmergecontroller.swf?csConfigFile=http://irc.0x539.xyz/hp.xml Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 320 VIP website status:| Yes...

GitLab: GFM renderer leaks external issue tracker URL of private project

Vulnerability details The GFM renderer has the ability to cross-link issues between projects. When this project is private and the user doesn't have access, the link isn't made. This is good. However, when the private project has an external issue tracker set up, an attacker can extract the...

Meld - Visual Diff And Merge Tool Targeted At Developers

Meld is a visual diff and merge tool targeted at developers. Meld helps you compare files, directories, and version controlled projects. It provides two- and three-way comparison of both files and directories, and has support for many popular version control systems. Meld helps you review code...

March 8, 2016, update for Project 2016 (KB3114865)

None None...

March 8, 2016, update for PowerPoint 2016 (KB3114847)

None None...

MySQL 5.5.x < 5.5.48 Multiple Vulnerabilities

The version of MySQL running on the remote host is 5.5.x prior to 5.5.48. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the DML subcomponent that allows an authenticated, remote attacker to impact integrity and availability. CVE-2016-0640 - An unspecifie...

Internet Bug Bounty: Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack

See my official writeups here: http://bugs.python.org/issue25944 http://bugs.python.org/issue25945 The maintainers merged these bug reports. In one case, the type confusion leads to a reliable control of the instruction pointer as calling repr on a corrupted partial calls a function pointer that ...

Fedora 21 : qemu-2.1.3-11.fc21 (2015-16368)

CVE-2015-6815: net: e1000: infinite loop issue bz 1260225 CVE-2015-6855: ide: divide by zero issue bz 1261793 CVE-2015-5278: Infinite loop in ne2000receive bz 1263284 CVE-2015-5279: Heap overflow vulnerability in ne2000receive bz 1263287 Make block copy more stable bz 1264416 Fix hang at start of...

ZAP 2.4.2 - Penetration Testing Tool for Testing Web Applications

The Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testin...

Backup Copy Job Failures when using ExaGrid de-duplicating storage

Challenge Backup Copy Jobs can fail when writing to ExaGrid storage. Cause De-duplicating storage can incorrectly update existing backup files during Veeam "merge" operation. Solution Make sure your ExaGrid Storage firmware version is 4.7.0 P52 or newer. For additional information please contact...

CVE-2015-3360

Cross-site scripting XSS vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3360

CVE-2015-3360 describes a Cross-Site Scripting (XSS) vulnerability in the Drupal contributed Term Merge module for 7.x-1.x prior to 7.x-1.2. The issue arises because user input is not sufficiently filtered under certain conditions, allowing remote authenticated users to inject arbitrary web scrip...

Drupal Term Merge Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Term Merge module because it fails to properly filter user-supplied input. An attacker may be able to exploit this vulnerability to execute arbitrary script code ...

Apache HTTP Server mod_dav MERGE Request Denial of Service - Ver2 (CVE-2013-1896)

A denial of service vulnerability has been reported in the moddav component of Apache HTTP Server. The vulnerability is due to a NULL pointer dereference when processing a MERGE request with a URI whose source href points to a non-DAV configured URI. A remote attacker can send a crafted HTTP...

Low: Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update

Updated qemu-kvm-rhev packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Null pointer dereference

The cachemergeheadersout function in modules/cache/cacheutil.c in the modcache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty HTTP Content-Type header...