CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the 1 Data Set Authoring or 2...

Sql injection

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the 1 Data Set Authoring or 2...

CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the 1 Data Set Authoring or 2...

CVE-2016-4999

CVE-2016-4999 applies to Dashbuilder prior to 0.6.0.Beta1, where a SQL injection flaw exists in getStringParameterSQL (DefaultDialect.java) that can allow remote attackers to execute arbitrary SQL via a data set lookup filter in the Data Set Authoring or Displayer editor UI. Multiple records (NVD...

Perixx Computer PERIDUO-710W Insufficient Protections

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-045 Product: PERIDUO-710W Manufacturer: Perixx Computer GmbH Affected Versions: Part No. KG-1027 Tested Versions: Part No. KG-1027 Vulnerability Type: Insufficient Protection of Code Firmware and Data Cryptographic Key Risk...

ReDoS via long string of semicolons

Overview Affected versions of tough-cookie may be vulnerable to regular expression denial of service when long strings of semicolons exist in the Set-Cookie header. Recommendation Update to version 2.3.0 or later. References GitHub Advisory...

GLSA-201607-12 : Exim: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201607-12 Exim: Arbitrary code execution Vulnerabilities have been discovered in Exims implementation of set-uid root and when using perlstartup. These vulnerabilities require a user account on the Exim server and a configuration...

Exim: Arbitrary code execution

Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description Vulnerabilities have been discovered in Exim’s implementation of set-uid root and when using ‘perlstartup’. These vulnerabilities require a user account on the Exi...

The vulnerability of WebSphere Application Server application servers allows attackers to gain access to protected information.

The vulnerability of WebSphere Application Server applications stems from the absence of the HTTPOnly flag in the Set-Cookie header. Exploiting this vulnerability allows a malicious actor to gain access to protected information through a cookie-based access scenario...

CVE-2016-4999

A security flaw was found in the way Dashbuilder performed SQL datasets lookup requests in the Data Set Authoring UI or the Displayer editor UI. A remote attacker could use this flaw to conduct SQL injection attacks via specially-crafted string filter parameter...

Dashbuilder: SQL Injection on data set lookup filters

A security flaw was found in the way Dashbuilder performed SQL datasets lookup requests in the Data Set Authoring UI or the Displayer editor UI. A remote attacker could use this flaw to conduct SQL injection attacks via specially-crafted string filter parameter...

CVE-2016-2923

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

Design/Logic Flaw

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

CVE-2016-2923

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

The vulnerability of the _netr_ServerPasswordSet function in the Samba networking communication software package allows a hacker to execute arbitrary code with administrator privileges.

The vulnerability of the netrServerPasswordSet function in the Samba networking software package is related to code errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with administrator privileges using a specially crafted call to the...

The vulnerability of Samba software allows a remote attacker to compromise the confidentiality and integrity of protected information.

A vulnerability exists in the ownerset function in smbcacls.c within smbcacls in Samba, due to the deletion of the access control list when the --chown or --chgrp parameter is used. Exploiting this vulnerability allows malicious actors to circumvent access restrictions by making unauthorized...

The vulnerability of the NameSurfer IP address management server allows a malicious actor to perform unauthorized privilege escalation within the system.

The vulnerability of the Nixu NameSurfer software lies in errors in the program’s code. Exploiting this vulnerability allows a malicious individual to unauthorizedly elevate privileges within the system by writing a path to their file into the $PATH variable, and having that application executed...

DEBIAN-CVE-2016-4997

The compat IPTSOSETREPLACE and IP6TSOSETREPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service memory corruption by leveraging in-container root access to provide a crafted offset value that...

Radancy: Application error message

Attack details HTTP Header input X-Forwarded-For was set to 12345'"'";|%00%0d%0a%bf%27'??? Error message found: Warning: inetpton function.inet-pton: Unrecognized address 12345'"\'\";|%00%0d%0a%00%bf%27' in...

UBUNTU-CVE-2012-6703

Integer overflow in the sndcomprallocatebuffer function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service insufficient memory allocation or possibly have unspecified other impact via a crafted...