grub2 security, bug fix, and enhancement update

2.02-0.29.0.1 - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms bug 19231481 - update Oracle Linux certificates Alexey Petrenko - Put 'with' in menuentry instead of 'using' bug 18504756 - Use different titles for UEK and RHCK kernel...

Shopify: An administrator without any permission is able to get order notifications using his APNS Token.

Description ---- An administrator who lacks the 'Settings' permission is not able to add notifications through the UI. But the endpoint shop.myshopify.com/admin/mobiledevices.json does allow the unprivileged user to add his own device. PoC ---- This PoC simply show how to get & re-use the mobile...

WordPress My Category Order Plugin <= 4.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Vulnerable parameters: "cats" and "hdnParentID". Solution Upgrade the plugin...

Threat Outbreak Alert RuleID19474: Email Messages Distributing Malicious Software on November 18, 2015

Medium Alert ID: 42159 First Published: 2015 November 18 21:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19474KVR may contain the following files: Nam...

Shopify: deleted staff member can add his amazon marketplace web services account to the store.

Hi , I have found that if a staff member had access to settings for one single time , he can add his amazon marketplace web services account to the store anytime he wants even after he is deleted from the admins which allows him to fulfill orders for the online store using his own inventory store...

ovh.ie XSS vulnerability

Vulnerable URL: https://www.ovh.ie/cgi-bin/newOrder/order.cgi?plan=perso2014'--...

Multiple IBM products are vulnerable

IBM Maximo Asset Management and others are products of IBM Corporation of the U.S.A. IBM Maximo Asset Management for SmartCloud Control Desk SCCD is a suite of comprehensive asset lifecycle and maintenance software for asset and service management solutions SCCD. Maximo Asset Management for Tivol...

CVE-2015-7395

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

CVE-2015-7395

IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 FP002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 FP002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for...

CVE-2015-7395

CVE-2015-7395 affects IBM Maximo Asset Management and related IBM products (SmartCloud Control Desk, Tivoli IT Asset Management for IT, Service Request Manager, CRM/DB components). The issue allows a remote authenticated user to bypass work-order change restrictions due to improper access control...

Threat Outbreak Alert RuleID19215: Email Messages Distributing Malicious Software on November 6, 2015

Medium Alert ID: 41962 First Published: 2015 November 6 15:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19215 may contain the following files: Name |...

site5.com XSS vulnerability

Vulnerable URL: http://www.site5.com/order/vps/ Details: Description| Value ---|--- Patched:| Yes, at 06.11.2016 Latest check for patch:| 06.11.2016 12:17 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 8731 Google Pagerank| 6 VIP website status:| Yes Check...

Threat Outbreak Alert RuleID18929: Email Messages Distributing Malicious Software on March 12, 2016

Medium Alert ID: 41699 First Published: 2015 October 26 13:44 GMT Last Updated: 2016 March 14 12:26 GMT Version: 10 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18929 a...

Threat Outbreak Alert RuleID18849: Email Messages Distributing Malicious Software on October 22, 2015

Medium Alert ID: 41666 First Published: 2015 October 22 16:20 GMT Last Updated: 2015 October 23 12:56 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18849...

Threat Outbreak Alert RuleID18887: Email Messages Distributing Malicious Software on October 22, 2015

Medium Alert ID: 41668 First Published: 2015 October 22 14:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18887 may contain the following files: Name |...

UBUNTU-CVE-2015-5283

The sctpinit function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service panic or memory corruption by creating SCTP sockets before all of the steps have finished...

SQL Injection

Overview Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 o...

Threat Outbreak Alert RuleID18697: Email Messages Distributing Malicious Software on October 15, 2015

Medium Alert ID: 41535 First Published: 2015 October 15 13:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18697 may contain the following files: Name |...

Oracle: Security Advisory (ELSA-2007-0964)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nodejs: denial of service

A vulnerability has been discovered in the HTTP pipeline handling that is leading to an application crash. This problem is caused by out-of-order responses being sent to the client within a single pipelined connection...