July 11, 2017—KB4025342 (OS Build 15063.483)

None None...

Yaws 1.91 - Remote File Disclosure

Yaws 1.91 - Remote File Disclosure + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/YAWS-WEB-SERVER-v1.91-UNAUTHENTICATED-REMOTE-FILE-DISCLOSURE.txt + ISR: ApparitionSec Vendor: ========== yaws.hyber.org Product: =========...

CVE-2015-3189

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable...

PT-2017-6643

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions v209 or earlier UAA Standalone versions 2.2.6 or earlier Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier Description The change email form in UAA is susceptible to a CSRF attack, allowing an...

PT-2017-6641

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions v208 or earlier UAA Standalone versions 2.2.5 or earlier Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier Description The issue arises when a user changes their email address, and old password...

PT-2017-6642

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions v209 or earlier UAA Standalone versions 2.2.6 or earlier Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier Description The UAA logout link is susceptible to an open redirect, allowing an attacker...

CVE-2015-3189: Weak Password Recovery Mechanism for Forgotten Password

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable...

CVE-2015-3190: URL Redirection to Untrusted Site

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter...

CVE-2017-7967

All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes the software to halt or not start when trying to open the corrupted file. This vulnerability occurs...

thunderbird security update

CentOS Errata and Security Advisory CESA-2017:1201 An update for thunderbird is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

CVE-2017-7967: Improper Restriction of Operations within the Bounds of a Memory Buffer

All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes the software to halt or not start when trying to open the corrupted file. This vulnerability occurs...

[SECURITY] Fedora 25 Update: thunderbird-52.1.0-1.fc25

Mozilla Thunderbird is a standalone mail and newsgroup client...

March 22, 2017—KB4016636 (OS Build 10586.842)

None None...

[SECURITY] Fedora 24 Update: thunderbird-45.7.0-1.fc24

Mozilla Thunderbird is a standalone mail and newsgroup client...

January 30, 2017—KB4010672 (OS Build 14393.729)

None None...

[SECURITY] Fedora 25 Update: thunderbird-45.6.0-2.fc25

Mozilla Thunderbird is a standalone mail and newsgroup client...

Downloads Resources over HTTP

Overview Affected versions of selenium-standalone-painful insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in...

Downloads Resources over HTTP

Overview Affected versions of scalajs-standalone-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Ipsilon Denial of Service Vulnerability

Ipsilon is a server and toolkit for configuring Apache-based service providers to provide federated authentication SSO to web applications with pluggable standalone modwsgi applications. A denial of service vulnerability exists in Ipsilon that can be exploited by an attacker to cause a denial of...

thunderbird security update

CentOS Errata and Security Advisory CESA-2016:1985 An update for thunderbird is now available for Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...