ansible -- use of predictable paths in lxc_container

Ansible developers report: CVE-2016-3096: do not use predictable paths in lxccontainer do not use a predictable filename for the LXC attach script don't use predictable filenames for LXC attach script logging don't set a predictable archivepath this should prevent symlink attacks which could resu...

myOpel - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application myOpel published at the 'play' market has multiple vulnerabilities...

Gratipay: prevent content spoofing on /search

i have found content spoofing go to this URL...

Debian DLA-403-1 : radicale security update

Several issues have been discovered by Unrud in Radicale, a calendar and addressbook server. A remote attacker could exploit these vulnerabilities and call arbitrary functions by sending crafted HTTP requests. CVE-2015-8748 Prevent regex injection in rights management. Prevent crafted HTTP reques...

FreeBSD : privoxy -- multiple vulnerabilities (a763a0e7-c3d9-11e5-b5fe-002590263bf5)

Privoxy Developers reports : Prevent invalid reads in case of corrupt chunk-encoded content. CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer. Remove empty Host headers in client requests. Previously they would result in invalid reads. CVE-2016-1983. Bug discovered with afl-fuzz a...

CVE-2015-8898

The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted image file...

Oracle: Security Advisory (ELSA-2014-1004)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle: Security Advisory (ELSA-2013-0131)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Prevent Activity feed information leakage by allowing permanently disabling of it

It seems that the sensitive information leakage is something almost impossible to avoid when you have a pair of JIRA instances, internal and external, which are connected one to another. Having them connected is clearly a business requirement for being able to cross link issues and to copy them...

iOS 9 vulnerability: using Siri to bypass the lock screen to access private pictures and contacts-vulnerability warning-the black bar safety net

! A hacker found a new, very simple method, which utilizes Apple's personal assistant Siri, bypassing running iOS 9 lockscreen iOS devices iPhone, iPad, or iPod touch a secure mechanism, which makes an attacker in 3 0 seconds, perhaps less time will be able to access the device photos and contact...

Where is your social security number today?

As April 15 approaches, the "water cooler" talk revolves around all types of topics related to the tax season. However, due to the overwhelming number of security breaches reported this past year, several individuals are finding that fraudulent tax filings were created with voluntarily provided...

IT-Grundschutz M4.339: Verhindern unautorisierter Nutzung von Wechselmedien unter Windows-Clients ab Windows Vista

IT-Grundschutz M4.339: Verhindern unautorisierter Nutzung von Wechselmedien unter Windows-Clients ab Windows Vista. Stand: 15. Ergnzungslieferung 15. EL. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

IT-Grundschutz M4.339: Verhindern unautorisierter Nutzung von Wechselmedien unter Windows-Clients ab Windows Vista

IT-Grundschutz M4.339: Verhindern unautorisierter Nutzung von Wechselmedien unter Windows-Clients ab Windows Vista. Stand: 15. Ergänzungslieferung 15. EL. OpenVAS Vulnerability Test $Id: GSHBM4339.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.339 Authors: Thomas Rotter...

Zer0 - Secured file deletion made easy

Zer0 is a user friendly file deletion tool with a high level of security. With Zer0, you'll be able to delete files and to prevent file recovery by a 3rd person. So far, no user reported an efficient method to recover a file deleted by Zer0. Features User friendly HMI : Drag'n'drop, 1 click and t...

Updated busybox packages fix CVE-2014-9645

Updated busybox packages fix security vulnerability: The modprobe command in busybox before 1.23.0 uses the basename of the module argument as the module to load, allowing arbitrary modules, even when some kernel subsystems try to prevent this CVE-2014-9645...

OracleVM 2.2 : kernel (OVMSA-2009-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - security require root for mmapminaddr Eric Paris 518142 518143 CVE-2009-2695 - md prevent crash when accessing suspend sysfs attr Danny Feng 518135 518136 CVE-2009-2849 - nfs knfsd: fix NFSv4 OEXCL...

USN-2413-1: AppArmor vulnerability

An AppArmor policy miscompilation flaw was discovered in apparmorparser. Under certain circumstances, a malicious application could use this flaw to perform operations that are not allowed by AppArmor policy. The flaw may also prevent applications from accessing resources that are allowed by...

Fedora 20 : mediawiki-1.23.2-1.fc20 (2014-9583)

This is a major update from the 1.21 branch to the 1.23 long term support branch. - bug 68187 SECURITY: Prepend jsonp callback with comment. - CVE-2014-5241 - bug 66608 SECURITY: Fix for XSS issue in bug 66608: Generate the URL used for loading a new page in JavaScript,instead of relying on the U...

yum-updatesd security update

1:0.9-6 - updatesd: prevent installing unsigned packages. - Resolves: rhbz1125185...

Design/Logic Flaw

OpenStack Heat Templates heat-templates, as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download 1 packages and 2 signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors...