squid: some code paths fail to check bounds in string object

Incorrect boundary checks were found in the way squid handled headers in HTTP responses, which could lead to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response...

squid: wrong error handling for malformed HTTP responses

It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response...

Information modification vulnerability in multiple Samsung Galaxy devices

The Samsung Galaxy S4 and others are smart mobile devices released by the South Korean company Samsung Samsung. The information modification vulnerability exists in Samsung Galaxy S4 to S7 devices and stems from the program's failure to validate BroadcastReceiver responses. An attacker could...

IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities

Binary data 9699.prm...

CVE-2016-6380

The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service data corruption or device reload via a crafted DNS response, aka Bug ID CSCup90532...

CVE-2016-5986

IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors...

MGASA-2016-0326 Updated gnutls packages fix security vulnerability

An issue was found in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid CVE-2016-7444...

Updated gnutls packages fix security vulnerability

An issue was found in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid CVE-2016-7444...

UBUNTU-CVE-2016-6172

PowerDNS aka pdns Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service memory exhaustion and secondary DNS server crash via a large 1 AXFR or 2 IXFR response...

MGASA-2016-0320 Applications using libtorrent-rasterbar are vulnerable to denial of service

Applications using libtorrent-rasterbar are vulnerable to denial of service. An attacker-controlled torrent tracker can crash victim torrent clients by sending malformed GZIP responses CVE-2016-7164...

CVE-2016-7444

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances...

libtorrent-rasterbar: denial of service

A bug has been found in the libtorrent-rasterbar code handling GZIP-encoded responses from a tracker, where malformed responses could lead to a crash...

OLX: Bypassing Phone Verification For Posting AD On OLX

Overview In computer networks, rate limiting is used to control the rate of traffic sent or received by a network interface controller. It can be induced by the network protocol stack of the sender due to a received ECN-marked packet and also by the network scheduler of any router along the way...

Remote Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-07035)

F5 BIG-IP is an all-in-one network device from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A remote denial of service vulnerability exists in multiple F5 BIG-IP products, which can be exploited by an attacker to cause a...

Squid < 3.5.17, 4.0.9 Multiple Vulnerabilities

Binary data 802013.prm...

The vulnerability of the Windows operating system allows a hacker to intercept network traffic or bypass the Enhanced Protected Mode (EPM) or application’s security mechanisms. As a result, unauthorized content can be displayed in the browser.

The vulnerability of the Windows operating system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to intercept network traffic or bypass the Enhanced Protected Mode EPM or application security mechanisms. As a result, unauthorized content can be...

HackerOne: Ability to monitor reports' submission in real time

Hey , I would like to report an issue with the server responses that allow anyone users to monitor and track the reports' submission and the platform activity . Description : The issue occurs on the endpoint '/reports/reportid.json' due to the difference between server responses for submitted...

[SECURITY] [DLA 588-1] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 Two security related problems have been found in the mongodb package, related to logging. CVE-2016-6494 World-readable .dbshell history file TEMP-0833087-C5410D Bruteforcable challenge responses in...

The vulnerability of the Firefox browser, which allows a remote attacker to bypass certificate verification

The vulnerability of the Firefox browser in handling alternative HTTP services allows a malicious actor to bypass the X.509 certificate verification for SSL servers by modifying the server address in the uri-host header of the HTTP/2 response...

The vulnerability of Samba software allows a remote attacker to compromise the accessibility of protected information.

The vulnerability exists in the internal Samba DNS server due to the lack of checking the QR field in the header of the incoming DNS request before sending the response. Exploiting this vulnerability allows malicious actors to cause service failures excessive CPU usage and reduced bandwidth...