Amazon Linux: Security Advisory (ALAS-2016-731)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-1000033

Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...

UBUNTU-CVE-2016-1000033

Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...

Command Injection Vulnerability in AVTECH DVRs

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. A command injection vulnerability exists in AVTECH DVR. Because the interface query function does not filter and validate th...

Git-hub Remote Code Execution Vulnerability

GitHub is a hosting platform for open source and private software projects. A remote code execution vulnerability exists in GitHub repository URLs are not sufficiently validated, which can be exploited by an attacker to execute arbitrary code...

Acrobat Reader DC XFA CPDField Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Acrobat Reader DC XFA template Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

cfme: Incorrect sanitization in regular expression engine

An input validation flaw was found in the way CloudForms regular expressions were passed to the expression engine via both the JSON API and the web based UI. A user with the ability to view collections and filter them could use this flaw to execute arbitrary shell commands on the host with the...

CVE-2016-5963

IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

The vulnerability of the Mac OS X operating system allows a hacker to execute arbitrary code in a privileged context.

The vulnerability of the Mac OS X operating system’s login window exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using a specially created application...

Design/Logic Flaw

SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return values of ChopMonoAtY calls, which allows remote attackers to cause a denial of service uninitialized memory access and application crash or...

RaiseDreams Crowdfunding System 2.2.4 suffers from a login validation design vulnerability

RaiseDreams is an enterprise-level crowdfunding website platform. A login validation design vulnerability exists in the RaiseDreams crowdfunding system 2.2.4, which arises because the user login password is not verified, allowing an attacker to exploit the vulnerability to log in to the system an...

The vulnerability of the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of the Android operating system’s telephony component exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to cause a service failure by changing the value of NITZ to 19.01.2016 or later, thereby misconfiguring the system time...

UBUNTU-CVE-2014-9410

The vfe31procgeneral function in drivers/media/video/msm/vfe/msmvfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, does not validate a certain id value, which allows attackers to gain...

UBUNTU-CVE-2014-9886

arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices does not properly validate input parameters, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28815575 and Qualcomm interna...

UBUNTU-CVE-2014-9884

drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices does not validate certain pointers, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28769920 and Qualcomm internal bug CR580740...

UBUNTU-CVE-2016-3824

omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827...

RHEL 7 : golang (RHSA-2016:1538) (httpoxy)

An update for golang is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CentOS 7 : golang (CESA-2016:1538) (httpoxy)

An update for golang is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

The vulnerability of the Android operating system allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability in the decoder/ih264dprocessintramb.c file of the Android operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or trigger a service failure memory corruption by using a specially...