UBUNTU-CVE-2016-9904

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox 50.1, Firefox...

DEBIAN-CVE-2016-9860

An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg'AllowArbitraryServer'=true. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

DEBIAN-CVE-2016-6628

An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

UBUNTU-CVE-2016-6628

An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

UBUNTU-CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

ASUS RT-N10 CSRF / Code Execution / XSS / Open Redirection

Hello list! There are multiple vulnerabilities in ASUS Wireless Router RT-N10. There are Code Execution, Cross-Site Scripting and URL Redirector Abuse vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are the next models: ASUS RT-N10, RT-N10E,...

FBI Arrests Two Hackers Who Hacked US Spy Chief, FBI and CIA Director

US authorities have arrested two North Carolina men on charges that they were part of the notorious hacking group "Crackas With Attitude." Crackas with Attitude is the group of hackers who allegedly was behind a series of audacious and embarrassing hacks that targeted personal email accounts of...

WS-2016-7103

In “Cloudera/Hue”, versions 3.6.0 to 3.11.0 and cdh5.0.0-Release to cdh5.8.1-release are vulnerable to XSS in beeswax old editor...

Unspecified Vulnerability in Apache TomEE

Apache TomEE is the United States Apache Apache Software Foundation developed a Java EE server. A security vulnerability exists in Apache TomEE versions prior to 7.0.0-M3 and version 1.7.4, no details of the vulnerability are available at this time...

Read-only share recipient can restore old versions of file (NC-SA-2016-005)

The restore capability of Nextcloud was not verifying whether an user has only read-only access to a share. Thus an user with read-only access was able to restore old versions...

'Dropping Elephant' APT Attackers Targets Old Windows Flaws

Don’t judge an APT by its exploits alone. That’s the takeaway from a report that details a unique advanced persistent threat that leverages a kludge of unsophisticated, outdated and rudimentary attack tools to conduct cyber espionage. The target of the attacks are government and diplomatic agenci...

The vulnerability of the Zyxel ZLD operating system allows a remote attacker to escalate their privileges.

The Zyxel ZyWALL USG 300 network firewall/routing system has a bug during the default password change process. As a result, the Quagga and Zebra processes continue to respond to requests made with the old password...

FantasyTote: Insecure password change mechanism may lead to full account takeover

Description: The password change mechanism which is located at https://www.fantasytote.com/users/edit is insecure as there is no old password field deployed in it. Any unauthorized user can access the account and can change the password directly without knowing the old password. The current...

PT-2016-6158

Name of the Vulnerable Software and Affected Versions Geospatial Information Authority of Japan aka GSI Old GSI Maps versions prior to January 2015 Description The issue allows remote attackers to read arbitrary files via unspecified vectors due to a directory traversal vulnerability in...

WordPress OPS Old Post Spinner 插件任意文件包含漏洞

No description provided by source...

SUSE-SU-2016:1457-1 Security update for cyrus-imapd

Previous versions of cyrus-imapd would not allow its users to disable old protocols like SSLv1 and SSLv2 that are unsafe due to various known attacks like BEAST and POODLE. https://bugzilla.cyrusimap.org/showbug.cgi?id=3867 remedies this issue by adding the configuration option 'tlsversions' to...

Source code of Old_GSI_Maps prior to January, 2015 vulnerable to directory traversal

Overview kml2jsonp.php contained in source code of OldGSIMaps prior to January, 2015 provided by the Geospatial Information Authority of Japan GSI contains a directory traversal vulnerability CWE-22. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

mediawiki -- multiple vulnerabilities

Mediawiki reports: Security fixes: T122056: Old tokens are remaining valid within a new session T127114: Login throttle can be tricked using non-canonicalized usernames T123653: Cross-domain policy regexp is too narrow T123071: Incorrectly identifying http link in a's href attributes, due to m...

Microsoft Security Intelligence Report: Top Takeaways

Microsoft’s Security Intelligence Report painted a bleak picture when it comes to malware, fraudulent login attempts and the staying power of really old exploits. Key findings in the 198-page biannual report run the gamut illustrating how old threats die hard and what new threats are on the...

Google Chrome Arbitrary Code Execution Vulnerability (CNVD-2016-02445)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in versions of Google Chrome prior to 50.0.2661.75. A remote attacker can exploit the vulnerability to execute arbitrary code...