Debian Security Advisory DSA 3670-1 (tomcat8 - security update)

Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. OpenVAS Vulnerability Test $Id: deb3670.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3670-1 using nvtgen 1.0 Script...

rubygem-activerecord: unsafe query generation in Active Record

A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application...

Dailyworkout - Free - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Dailyworkout - Free published at the 'play' market has multiple vulnerabilities...

PHP 'ext/gd/gd.c' Heap Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language. PHP 'ext/gd/gd.c' suffers from a heap buffer overflow vulnerability due to the program failing to adequately filter user-supplied data. Allowing an attacker to exploit the vulnerability would allow execution of arbitrary script co...

Университет ИТМО - External URLs, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Университет ИТМО published at the 'play' market has multiple vulnerabilities...

Fedora 24 : pulp / pulp-docker / pulp-ostree / pulp-puppet / pulp-python / etc (2016-4373f7d32a)

2.8.6 is a security and bugfix release. Included in the list of fixed issues in 2.8.5 are two CVEs : - CVE-2016-3696: Leakage of CA key in pulp-qpid-ssl-cfg - CVE-2016-3704: Unsafe use of bash $RANDOM for NSS DB password and seed Several issues with database migrations are also addressed in this...

CVE-2016-6186

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

PYSEC-2016-2

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

PYSEC-2016-2

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

SAP TREX Directory Traversal Vulnerability

SAP TREX is a search engine from SAP for the SAP NetWeaver integrated technology platform. A directory traversal vulnerability exists in SAP TREX because the program fails to adequately filter user-submitted input. An attacker could leverage the directory traversal character '...' The vulnerabili...

Stopwatch and Timer - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Stopwatch and Timer published at the 'play' market has multiple vulnerabilities...

Red Hat JBoss Products RMI Java Deserialization Vulnerability (Nov 2015) - Active Check

Red Hat JBoss products are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

انتخاباتي - Exported components, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application انتخاباتي published at the 'play' market has multiple vulnerabilities...

ИНТЕРПРОМБАНК Mobile-office - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application ИНТЕРПРОМБАНК Mobile-office published at the 'play' market has multiple vulnerabilities...

Jenkins CLI RMI Java Deserialization Vulnerability (Nov 2015) - Active Check

Jenkins is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins"; ...

Vulnerability in Objective Systems ASN1C Compiler Affecting Cisco Products

A vulnerability in the ASN1C compiler by Objective Systems affects Cisco ASR 5000 devices running StarOS and Cisco Virtualized Packet Core VPC systems. The vulnerability could allow an unauthenticated, remote attacker to create a denial of service DoS condition or potentially execute arbitrary...

Oracle Java MethodHandle Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the MethodHandle...

Joomla! SecurityCheck and SecurityCheck Pro SQL Injection Vulnerability

Joomla! is a U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features . SecurityCheck and SecurityCheck Pro are among the network security extension components. A SQL injection vulnerability exists in...

LI-8100App - SD-card access, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application LI-8100App published at the 'play' market has multiple vulnerabilities...

Bank Respublika MobilBank - Suspicious files, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Bank Respublika MobilBank published at the 'play' market has multiple vulnerabilities...