Microsoft Internet Explorer - CTreeNode::GetCascadedLang Use-After-Free (MS15-079)

Microsoft Internet Explorer - CTreeNode::GetCascadedLang Use-After-Free MS15-079 meta http-equiv="X-UA-Compatible" content="IE=10...

FreeBSD Security Advisory FreeBSD-SA-15:19.routed

============================================================================= FreeBSD-SA-15:19.routed Security Advisory The FreeBSD Project Topic: routed8 remote denial of service vulnerability Category: core Module: routed Announced: 2015-08-05 Credits: Hiroki Sato Affects: All supported version...

Cisco IOS XE Software TFTP DoS (cisco-sa-20150722-tftp)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the TFTP server functionality due to incorrect management of memory when handling TFTP requests. A remote, unauthenticated attacker can exploit this b...

Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135

This module enables you to track time on entities and comments. The module doesn't sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Add Time...

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134

The Open Semantic Framework OSF for Drupal is a middleware layer that allows structured data RDF and associated vocabularies ontologies to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting XSS because it did not sufficiently filter...

Fedora 21 : drupal7-views_bulk_operations-3.3-1.fc21 (2015-11278)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

Fedora 22 : drupal7-views_bulk_operations-3.3-1.fc22 (2015-11318)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

Fedora 22 : drupal7-migrate-2.8-1.fc22 (2015-11265)

7.x-2.8 See SA-CONTRIB-2015-130 Features and enhancements - Issue 2379289: migrate-import --update does not seem to work as expected, if map is not joinable, due to highwater field? - Issue 2403643: Migration::applyMappings unable to handle multifield subfields - Issue 2472045: Add language...

Path Breadcrumbs - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-133

This module enables you to configure breadcrumbs for any Drupal page. The module didn't sufficiently filter user input values the in administration interface. This vulnerability was mitigated by the fact that an attacker must have a role with the permission "Administer Path Breadcrumbs". CVE...

Cisco ASA OSPFv2 DoS Vulnerability (Cisco-SA-20150707-CVE-2015-4241)

Cisco ASA is prone to a OSPFv2 denial of service DoS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Cisco ASA OSPFv2 DoS Vulnerability (Cisco-SA-20150702-CVE-2015-4239)

Cisco ASA is prone to a OSPFv2 Denial of Service vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Cisco ASA Message Authentication Code Vulnerability (Cisco-SA-20150714-CVE-2015-4458)

Cisco ASA is prone to a Message Authentication Code checking vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132

Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. CVE identifiers issued CVE-2015-7226...

FreeBSD-SA-15:11.bind

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:11.bind Security Advisory The FreeBSD Project Topic: BIND resolver remote denial of service when validating Category: contrib Module: bind Announced:...

Brute Force Protection Bypass in backend login

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...

Migrate - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-130

This module enables you to manage migration processes through the administrative UI. The module doesn't sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by the fact that an attacker must have a role with...

me aliases - Moderately Critical - Access Bypass - SA-CONTRIB-2015-128

'me aliases' module provides shortcut paths to current user's pages, eg user/me, blog/me, user/me/edit, tracker/me etc. The view user argument handler for the 'me' module has an access bypass vulnerability where it does not check the supplied argument against the current user. This allows any use...

HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module allows account creation through social login when the configuration is set to allow user registration by...

Cisco ASA AES-GCM Vulnerability (Cisco-SA-20150616-CVE-2015-4550)

Cisco ASA is prone to an encrypted IPSec or IKEv2 modification vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...

Cisco ASA XAUTH Bypass Vulnerability (Cisco-SA-20150602-CVE-2015-0760)

A vulnerability in IKE version 1 code of Cisco ASA Software could allow an authenticated, remote attacker to bypass Extended Authentication XAUTH and successfully log in via IPsec remote VPN. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...