LogicalDoc Document Managment System CE: source code security analysis report

Several vulnerabilities were discovered in LogicalDOC 'LogicalDoc Document Managment System CE' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из...

UBUNTU-CVE-2016-2157

Cross-site request forgery CSRF vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage...

Epoch Web Mailing List Cross-Site Scripting Vulnerability

Epoch Web Mailing List is a set of web mailing lists from Epoch Japan. Epoch Web Mailing List suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user's...

Amazon Linux AMI : ImageMagick (ALAS-2016-699) (ImageTragick)

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities,...

Scientific Linux Security Update : ImageMagick on SL6.x, SL7.x i386/x86_64 (20160509) (ImageTragick)

Security Fixes : - It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the...

ImageMagick: SSRF vulnerability

A server-side request forgery flaw was discovered in the way ImageMagick processed certain images. A remote attacker could exploit this flaw to mislead an application using ImageMagick or an unsuspecting user using the ImageMagick utilities into, for example, performing HTTPS requests or opening...

TYPO3 Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system. TYPO3 suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when...

The vulnerability of the microprogramming software of the Medialink MWN-WARP300N router allows a hacker to enhance their privileges.

The vulnerability of the web-management interface of the Medialink MWN-WARP300N router software relates to the use of default passwords for user accounts. Exploiting this vulnerability could allow an attacker to gain increased privileges by utilizing Wi-Fi sessions...

CVE-2016-0787

The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...

CVE-2016-0787

The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...

CVE-2016-0787

The diffiehellmansha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."...

Siemens Industrial Products DROWN Vulnerability (Update C)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-103-03B Siemens Industrial Products DROWN Vulnerability that was published June 15, 2017, on the NCCIC/ICS-CERT web site. Siemens has found that a DROWNa Decrypting RSA with Obsolete and Weakened eNcryption attac...

How to make a session that spans multiple monitors with Linux Receiver

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information. This article explains how to make a session that spans multiple monitors with Linux Receiver...

Multiple vulnerabilities in OpenSSL affect AIX

IBM SECURITY ADVISORY First Issued: Mon Apr 4 11:04:25 CDT 2016 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory18.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory18.asc...

Cross-site request forgery

Administrate::ApplicationController actions don't have CSRF protection. Remote attackers can hijack user's sessions and use any functionality that administrate exposes on their behalf...

RHEL 6 / 7 : ISC DHCP Concurrent TCP Sessions DoS

RedHat Enterprise Linux 6 / 7 is affected by a denial of service vulnerability in the bundled ISC DHCP server due to a failure to properly restrict the number of concurrent TCP sessions to the ports the server uses for inter-process communications and control. An unauthenticated, remote attacker...

VulnCheck KEV: CVE-2015-5188

Cross-site request forgery CSRF vulnerability in the Web Console web-console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly formerly JBoss Application Server before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make...

GLSA-201603-15 : OpenSSL: Multiple vulnerabilities (DROWN)

The remote host is affected by the vulnerability described in GLSA-201603-15 OpenSSL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenSSL, the worst being a cross-protocol attack called DROWN that could lead to the decryption of TLS sessions. Please review the CVE...

The vulnerability of the Apache Tomcat application server allows attackers to gain access to web sessions.

The vulnerability of the Apache Tomcat application server is related to deficiencies in establishing the session identifier. Exploiting this vulnerability allows a malicious actor to gain access to web sessions by utilizing the requestedSessionSSL field in the request...

New Relic: All the active session should destroy when user change his password

hello security, There is an user sessions issue on your application that should be fixed. Proof of Concept Suppose, you have an account on newrelic.com Somehow an attacker manage to get your password and logged in your account.. after knowing that your ID has been compromised what you'll do ? i...