Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to escalate their privileges

The vulnerabilities of Microsoft Edge and Internet Explorer are related to errors in access control for namespace resources. Exploiting these vulnerabilities can allow a malicious actor to enhance their privileges remotely...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to escalate their privileges

The vulnerabilities of Microsoft Edge and Internet Explorer are related to errors in access control of namespace resources. Exploiting these vulnerabilities can allow a malicious actor to enhance their privileges using undefined vectors...

SSRF Team Calendars

The following endpoint has an SSRF that can be used to enumerate internal network resources that are not publicly exposed to the internet. noformat PUT /wiki/rest/calendar-services/1.0/calendar/subcalendars.json noformat PoC Using the "Team Calendar" macro, select the "Subscribe by URL" option...

DSA-3721-1 tomcat7 - security update

Bulletin has no description...

DSA-3720-1 tomcat8 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3721-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3720-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Tomcat 8.5.0 < 8.5.5 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.5and8.0.37security-8 advisory. - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,...

Apache Tomcat 6.0.x < 6.0.47 / 7.0.x < 7.0.72 / 8.0.x < 8.0.37 Multiple Vulnerabilities

Binary data 9723.pasl...

CVE-2016-6797

It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not...

OpenSSL SSL_peek Infinite Loop Denial of Service (CVE-2016-6305)

A denial-of-service vulnerability exists in OpenSSL. The vulnerability is due to an error in SSLpeek API that causes an infinite loop to occur when processing empty records. A remote, unauthenticated attacker can exploit this vulnerability by supplying an empty record during an SSL connection...

Content Security Policy (CSP) Bypass

Overview Affected versions of this package are vulnerable to Content Security Policy CSP Bypass. Extension URIs resource://... bypass Content-Security-Policy in Chrome and Firefox and can always be loaded. Now if a site already has a XSS bug, and uses CSP to protect itself, but the user has an...

UBUNTU-CVE-2016-6797

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was...

InfraPower PPS-02-S Q213V1 - Local File Disclosure

InfraPower PPS-02-S Q213V1 Local File Disclosure Vulnerability Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware: IPD-02-FW-v03 Summary: InfraPower Manager PPS-02-S is a FREE built-in GUI ...

tomcat -- multiple vulnerabilities

The Apache Software Foundation reports: Low: Unrestricted Access to Global Resources CVE-2016-6797 Low: Security Manager Bypass CVE-2016-6796 Low: System Property Disclosure CVE-2016-6794 Low: Security Manager Bypass CVE-2016-5018 Low: Timing Attack CVE-2016-0762...

CVE-2016-8503

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript...

CVE-2016-5575

Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via vectors related to Resources Module...

CVE-2016-5575

Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via vectors related to Resources Module...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via vectors related to Resources Module...

CVE-2016-5575

CVE-2016-5575 affects Oracle E-Business Suite, specifically the Common Applications Calendar (CAC) component. Versions 12.1.1–12.1.3 and 12.2.3–12.2.6 are vulnerable. The issue is described as an unspecified vulnerability in the CAC Resources Module that allows remote attackers to affect confiden...