OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

CVE-2016-4025

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email...

Spark 2.5 Arbitrary File Read

Hey folks, Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related to the project after trying 4 people over 2...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

CVE-2016-5635

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit...

CVE-2016-5635

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

CVE-2016-5635

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit...

CVE-2016-8286: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

Mindoktor: Storing sensitive information on cookie post-registration

Hello, I've noticed that upon registering the server sets a cookie named clinicclinic.PENTESTFLASH. In it, it stores all the information the user used to register. Sample request: POST /user/register HTTP/1.1 Host: clinic.pentest.mindoktor.io User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.1...

Unspecified Vulnerability in Oracle Database Server RDBMS Security Component (CNVD-2016-09696)

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing, etc. RDBMS Security is one of the database security storage component. A local security vulnerability exists in the RDBMS...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

UBUNTU-CVE-2016-5584

Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption...

PT-2016-7481

Name of the Vulnerable Software and Affected Versions Oracle MySQL versions 5.7.14 and earlier Description The issue affects the confidentiality of the system, allowing remote authenticated users to exploit it via vectors related to Server: Security: Privileges. This vulnerability can be easily...

Apache Tomcat JK ISAPI Connector Buffer Overflow Vulnerability

Apache Tomcat JK ISAPI Connector is a module for Apache or IIS to connect to the backend Tomcat , which supports clustering and load balancing and so on. A buffer overflow vulnerability exists in Apache Tomcat JK ISAPI Connector, which allows remote attackers to send specially crafted URIs to the...

Bumble: No rate-limit in SERVER_SECURITY_CHECK

Hi, When you login in another Ip address Badoo will ask to confirm mobile number to authenticate. The problem is that there is no limit of tries. This make this feature useless since it can be brute forced. In the video you can see at request 56 we found the right number which lead to...

CVE-2016-0870

CVE-2016-0870 affects Trane Tracer SC web server (versions 4.2.1134 and earlier). A remote attacker can read sensitive configuration files via a direct request, exposing information from specific directories. NVD assigns CVSSv3 base score 5.3 (Network, Low complexity, No privileges, Confidentiali...

mysql: unspecified vulnerability in subcomponent: Server: Security: Privileges (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges...

CVE-2016-3614

Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect availability via vectors related to Server: Security: Encryption...