JVN#37825153: AirDroid for Android vulnerable in handling of implicit intents

AirDroid for Android provided by SAND STUDIO contains a vulnerability in the handling of implicit intents. Impact Information in AirDroid may be leaked to a third party through a malicious Android application. Solution Update the Software Update to the latest version according to the information...

Microsoft Edge XSS Filter Bypass (MS15-107: CVE-2015-6058)

An XSS filter bypass vulnerability exists in Microsoft Edge. A remote attacker could exploit this issue by convincing target users to view a web page containing malicious JavaScript code with an effected version of Microsoft Edge. Successful exploitation could allow an attacker to take any action...

Cross-Site Scripting in extension "News system" (news)

It has been discovered that the extension "News system" news is susceptible to Cross-Site Scripting. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 3.2.1 and below Vulnerability Typ...

Information Disclosure in extension "Adminer" (t3adminer)

It has been discovered that the extension "Adminer" t3adminer is susceptible to Information Disclosure. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 7.0.1 and below Vulnerability...

Information Disclosure in extension "LDAP" (eu_ldap)

It has been discovered that the extension "LDAP" euldap is susceptible to Information Disclosure. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 2.8.18 and below Vulnerability Type:...

File Disclosure in extension "Zend Framework Integration" (zend_framework)

It has been discovered that the extension "Zend Framework Integration" zendframework is susceptible to File Disclosure. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.7.6 and belo...

SQL Injection in extension "http:BL Blocking" (mh_httpbl)

It has been discovered that the extension "http:BL Blocking" mhhttpbl is susceptible to SQL Injection. Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.1.7 and below Vulnerability...

Arbitrary Code Execution in extension "MK Forms" (mkforms)

It has been discovered that the extension "MK Forms" mkforms is susceptible to Arbitrary Code Execution Release Date: September 30, 2015 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: version 1.0.23 and below Vulnerability...

Good Technology Authentication Insecure Coupling

---------------------------------------------------------------- v1 - modzero Security Advisory: Insecure application-coupling in Good Authentication Delegation MZ-15-03 ---------------------------------------------------------------------...

WordPress Shortcodes Security Patch

WordPress core engine security vulnerabilities aren’t rare, but they are uncommon. Most issues affecting the integrity of sites running on the content management system are introduced by third-party plugins and put those sites at risk for a host of attacks. Today WordPress upgraded to version 4.3...

[security bulletin] HPSBGN03504 rev.1 - HP UCMDB, Local Disclosure of Sensitive Information

Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04790231 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04790231 Version: 1 HPSBGN03504 rev.1 - HP UCMDB, Local Disclosure of Sensitive...

DLA-301-1 python-django - security update

Bulletin has no description...

Details Surface on Patched Sandbox Violation Vulnerability in iOS

Apple patched an issue last week in iOS that could have allowed attackers to bypass the third-party app-sandbox protection mechanism on devices and read arbitrary managed preferences via a special app. The issue, which was present in versions of iOS prior to 8.4.1, stems from a vulnerability with...

Xceedium Xsuite Open Redirect Vulnerability

Xceedium Xsuite is a unified identity management solution from Xceedium that provides access control, monitoring and logging capabilities for hybrid cloud environments. The solution supports access control policies based on roles or individual users. An open redirection vulnerability exists in...

[SECURITY] Fedora 21 Update: rubygems-2.2.5-100.fc21

RubyGems is the Ruby standard for publishing and managing third party libraries...

Apple iOS Other App Management Parameters Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows malicious apps to utilize third-party app sandbox profiles to read information about other apps' administrative parameters...

Apple iOS Sandbox_profiles Component Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a security vulnerability that allows malicious apps to utilize third-party app sandbox profiles to read information about other apps' administrative parameters...

django -- multiple vulnerabilities

Tim Graham reports: Denial-of-service possibility in logout view by filling session store Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view provided it wasn't decorated with django.contrib.auth.decorators.loginrequired as done in the admin...

CVE-2015-3793

CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...

Design/Logic Flaw

CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app...