CVE-2016-0456

Affected software: Oracle E-Business Suite 12.1/12.2 with Application Mgmt Pack for E-Business Suite REST component. Vulnerability: unspecified issue in REST Framework that could affect confidentiality. Potential root-cause mentions an XXE claim; Oracle has not commented on third-party XXE claims...

CVE-2016-0534

CVE-2016-0534 affects Oracle E-Business Suite (12.1.1–12.1.3) specifically the Oracle Project Contracts Printing component. The vulnerability is described as unspecified and enables remote attackers to affect data integrity via unknown vectors related to Printing. The available documents do not p...

CVE-2016-1904

Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the 1 phpescapeshellcmd or 2 phpescapeshellarg function, leading to a heap-based buffer overflow...

CVE-2016-1897

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Streaming HLS M3U8 file, leading to an external HTTP request in which the URL string contains the first line of a local file...

CVE-2016-0029

Technical details (affected product/version, root cause, exploit specifics, impact, and remediation) are not publicly available in the provided connected documents for CVE-2016-0029. Monitor for updates from trusted sources.

Memory corruption

libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive information or cause a denial of service memory corruption via a crafted XML document, a different vulnerability than CVE-2015-7116...

CVE-2015-5310

CVE-2015-5310 affects wpa_supplicant 2.x prior to 2.6. The WNM Sleep Mode code does not properly ignore key data in response frames when MFP was not negotiated, allowing remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service via a WNM Sleep Mode response....

Code injection

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

MGASA-2015-0488 Updated perl-HTML-Scrubber packages fix CVE-2015-5667

Updated perl-HTML-Scrubber package fixes security vulnerability: Cross-site scripting XSS vulnerability in the HTML-Scrubber module before 0.15 for Perl, when the comment feature is enabled, allows remote attackers to inject arbitrary web script or HTML via a crafted comment...

CVE-2015-7906

The vulnerability CVE-2015-7906 affects LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices. It enables remote attackers to read a password-hash backup file via unspecified vectors (information disclosure). Affected products are network routers; the issue is exploitable remotely w...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2015-08137)

IBM WebSphere Portal is a suite of enterprise portal software from IBM in the United States. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...

CVE-2015-5309

Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code via an ECH erase characters escape sequence with a large parameter value, which triggers a buffer underflow...

Cross site request forgery (csrf)

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the 1 Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or 2...

CVE-2015-8076

The indexurlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read...

CVE-2015-8395

PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and...

CVE-2015-8381

The compileregex function in pcrecompile.c in PCRE before 8.38 and pcre2compile.c in PCRE2 before 10.2x mishandles the /?J:?|:?|?'R'\k'R'|?'R'H'Rk'Rf|s?'R'/ and /?J:?|:?|?'R'\z?|?'R'\k'R'|?'R'k'R'|?'R'H'Ak'Rf|s?'R'/ patterns, and related patterns with certain group references, which allows remote...

OpenJDK: protected methods can be used as interface methods via DirectMethodHandle (Libraries)

Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries...

CVE-2015-6374

The CVE-2015-6374 vulnerability affects Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices, where the web interface inadequately restricts IFRAME usage. The root cause is insufficient input sanitization of iframe data in HTTP requests, enabling remote attackers to pe...

CVE-2015-2213

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

CVE-2015-4513

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...