Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061

The Views Send module enables you to send mail to multiple users from a View. The module doesn't sufficiently filter potential user-supplied data when previewing the e-mail which can lead to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker mus...

Command Execution Vulnerability in NetSense Information Security Audit System

NetShen Security Audit System is a hardened computer that can defend against attacks with strong security protection. NetShen Security Audit System is capable of blocking illegal access and malicious attacks, blocking illegal commands, and filtering out all illegal access behaviors to target...

Microsoft Office 365 Word - Code Execution Vulnerability

Document Title: =============== Microsoft Office 365 Word - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1030 Release Date: ============= 2016-09-30 Vulnerability Laboratory ID VL-ID: ====================================...

Microsoft Unveils Cloud-Based Fuzz-Testing Service

Microsoft announced a cloud-based fuzz testing service called Project Springfield that identifies software bugs in applications that could turn into vulnerabilities. The service, announced at this week’s Microsoft 2016 Ignite technology conference in Atlanta, combines artificial intelligence and...

Update to the Microsoft Edge Web Platform on Windows Insider Preview Bug Bounty Program terms

On August 4, 2016 we launched a bounty program that targets Remote Code Execution RCE vulnerabilities in Microsoft Edge on the Windows Insider Preview Slow WIP slow. Today, we will be making additions to this bounty program. Since security is a continuous effort and not a destination, we prioriti...

CVE-2016-4749

Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file...

Design/Logic Flaw

Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file...

CVE-2016-4749

Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file...

MGASA-2016-0305 Updated mediawiki packages fix security vulnerability

Check read permission when loading page content in ApiParse CVE-2016-6331 Make blocks log users out if $wgBlockDisablesLogin is true CVE-2016-6332 Make $wgBlockDisablesLogin also restrict logged in permissions CVE-2016-6332 Require login to preview user CSS pages CVE-2016-6333 Escape '' in inline...

MS16-107: Description of the security update for Outlook 2016: September 13, 2016

None None...

Apple OS X Preview Remote Code Execution Vulnerability

Apple OS X is a specialized operating system developed by Apple for Mac computers. A security vulnerability exists in Apple Mac OS X EI Capitan version 10.11.6 Preview, which can be triggered by a heap overflow Out-Of-Bounds Write vulnerability when opening a carefully constructed PDF file, which...

PT-2016-6210 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.1 Description: The issue allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information. This is possible because...

CVE-2016-5400

Memory leak in the airspyprobe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service memory consumption via a crafted USB device that emulates many VFLTYPESDR or VFLTYPESUBDEV devices and performs many...

CVE-2016-1605

Directory traversal vulnerability in the ReportViewServlet servlet in the server in NetIQ Sentinel 7.4.x before 7.4.2 allows remote attackers to read arbitrary files via a PREVIEW value for the fileType field...

WebKit - TypedArray.copyWithin Memory Corruption

length; long to = argumentClampedIndexFromStartOrEndexec, 0, length; long from = argumentClampedIndexFromStartOrEndexec, 1, length; long final = argumentClampedIndexFromStartOrEndexec, 2, length, length; if final thisValue; long count = std::minlength - std::maxto, from, final - from; typename...

WebKit - TypedArray.fill Memory Corruption

WebKit - TypedArray.fill Memory Corruption length; unsigned begin = argumentClampedIndexFromStartOrEndexec, 1, length; unsigned end = argumentClampedIndexFromStartOrEndexec, 2, length, length; if end thisValue; if !thisObject-setRangeToValueexec, begin, end, valueToInsert return...

WebKit - TypedArray.fill Memory Corruption

length; unsigned begin = argumentClampedIndexFromStartOrEndexec, 1, length; unsigned end = argumentClampedIndexFromStartOrEndexec, 2, length, length; if end thisValue; if !thisObject-setRangeToValueexec, begin, end, valueToInsert return JSValue::encodejsUndefined; argumentClampedIndexFromStartOrE...

NIST Recommends SMS Two-Factor Authentication Deprecation

A U.S. government agency said the end is nigh for SMS-based two-factor authentication, citing a lack of security around the feature. The latest draft version of the Digital Authentication Guideline issued this week by the U.S. National Institute for Standards and Technology NIST said the practice...

SQL injection vulnerability in the zdbh parameter in the Bulletin/Msg_Preview.aspx page of the informatization management system of Guangzhou Zhongda Dongri Education Technology Co.

Guangzhou Zhongda Dongri Education Technology Co., Ltd. education information management system is to provide an integrated campus information solution. A SQL injection vulnerability exists in the Informationization Management System of Guangzhou Zhongda Dongri Education Technology Co. The lack o...

Google finally announces Android N's name and It's not Nutella

No, it's not Nutella. Google has finally announced the official name of the latest version of its Android mobile software, codenamed Android N: "Nougat." Yes, the next version of sugary snack-themed Android and the successor to Android Marshmallow will now be known as Android Nougat, the company...