3540 matches found
openssh, pam_ssh_agent_auth security update
CentOS Errata and Security Advisory CESA-2016:0466 Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...
openssh: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks...
New Relic: Stored XSS through Angular Expression Sandbox Escape
As an Admin of an account, I am able to set the Name of the Account to an Angular expression. This Angular expressions is resolved and executed on the Insights Welcome Page for anyone that is apart of the Account. Due to the ability to invite anyone even current NewRelic users to an Account, it...
The vulnerability of the Moodle learning management system allows a hacker to obtain confidential information.
The vulnerability of the coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo functions in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain confidential...
MGASA-2016-0082 Updated libssh packages fix CVE-2016-0739
Updated libssh packages fix security vulnerability: libssh versions 0.1 and above have a bits/bytes confusion bug and generate an abnormally short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the...
BSI-TR-03116-4 Policy
The German Federal Office for Information Security published a guideline with specifications for the use of communication methods. This script checks the specifications for securing communication using TLS by testing if at least one of the mandatory cipher suites are enabled on the target: - TLS...
Cisco Advanced Malware Protection and Email Security Appliance Proxy Engine Security Bypass Vulnerability
A vulnerability in the proxy engine of the Cisco Advanced Malware Protection AMP and the Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed file methods. An attacker could...
Fixed in Apache Tomcat 6.0.45
Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...
MS16-014: Description of the security update for Windows: February 9, 2016
None None...
Cisco Web Security Appliance Proxy Restrictions Bypass
According to its self-reported version, the Cisco Web Security Appliance WSA running on the remote host is affected by a security feature bypass vulnerability that allows an unauthenticated, remote attacker to bypass proxy restrictions via improper or malformed HTTP methods. C Tenable Network...
JDK: J9 JVM allows code to invoke non-public interface methods
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...
JDK: J9 JVM allows code to invoke non-public interface methods
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...
JDK: J9 JVM allows code to invoke non-public interface methods
The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods...
Apple Mac OSX - io_service_close Use-After-Free
/ Source: https://code.google.com/p/google-security-research/issues/detail?id=597 It turns out that the spoofed no-more-senders notification bug when applied to iokit objects was actually just a more complicated way to hit ::clientClose in parallel. We can in fact do this very simply by calling...
OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)
Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries...
Android WebView remote code execution vulnerability analysis-vulnerability warning-the black bar safety net
In the past period of time, the WebView remote code execution vulnerability can be said to be swept a large number of the Android App query some vulnerabilities of the platform can be substantially the case, given the many loopholes in the App and not disclosed, and therefore WebVeiw remote code...
Microsoft Windows JScript External Object Type Confusion Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code in applications using the JScript scripting language on vulnerable installations of Microsoft Windows. Microsoft Internet Explorer is an affected application. User interaction is required to exploit this vulnerability in that th...
Automatic SQL Database Injection: jSQL Injection
jSQL Injection is a lightweight application used to find database information from a distant server. Tool is free, open source and cross-platform Windows, Linux, Mac OS X, Solaris. Features: GET, POST, header, cookie methods Normal, error based, blind, time based algorithms Automatic best algorit...
USN-2818-1 openjdk-7 vulnerability
It was discovered that rebinding of the receiver of a DirectMethodHandle may allow a protected method to be accessed. Am attacker could use this to expose sensitive information or possibly execute arbitrary code...
OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)
Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries...