8184 matches found
CVE-2016-6345
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...
CVE-2016-6345: Exposure of Sensitive Information to an Unauthorized Actor
RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs...
Windows FLR fails with "Failed to create or open file [C:\Windows\system32\config\systemprofile\"
Challenge When attempting to perform a Guest OS File Level Restore from a Windows Filesystem the mount Backup Browser displays the error: The system cannot find the path specified. Failed to create or open file C:\Windows\system32\config\systemprofile...\veeamflr-.flat. Agent failed to process...
SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2016:2053-1)
This update for libvirt fixes one security issue : - CVE-2016-5008: Empty VNC password disables authentication. bsc987527 Additionally, the update includes the following non-security fixes : - Improve waiting for block job readines in virsh. bsc989755 - Parse negative values in augeas lenses...
CVE-2016-6345
It was found that there was insufficient use of randam values in RESTEasy async jobs. An attacker could use this flaw to steal user data. Mitigation Dont enable Async Jobs Service as details in the section, "2.10. RESTEASY ASYNCHRONOUS JOB SERVICE" of JBoss EAP 7 Developing Web Services...
USB Anti Forensic Tool: usbdeath
USB Anti Forensic Tool anti-forensic tool that writes udev rules for known usb devices and do some things at unknown usb device insertion or specific usb device removal. usbdeath is a small script inspired by usbkill , “an anti-forensic kill-switch that waits for a change on your USB ports and th...
UBUNTU-CVE-2016-5344
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to...
Debian DSA-3651-1 : rails - security update
Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as 'HTML safe' will not have quotes escaped when used as attribute values in tag helpers. %NASLMINLEVEL 70300 C Tenable...
[SECURITY] [DSA 3651-1] rails security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3651-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 25, 2016 https://www.debian.org/security/faq -...
python: http protocol steam injection attack
It was found that the Python's httplib library used by urllib, urllib2 and others did not properly check HTTPConnection.putheader function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values...
python: http protocol steam injection attack
It was found that the Python's httplib library used by urllib, urllib2 and others did not properly check HTTPConnection.putheader function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values...
CVE-2016-6316
It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting XSS attack...
Cisco IP Phone 8800 Series XSS Vulnerability (cisco-sa-20160810-ip-phone-8800)
Cisco IP Phone 8800 Series are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...
Rails 4 -- Possible XSS Vulnerability in Action View
Ruby Security team reports: There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. This vulnerability has been assigned the CVE identifier CVE-2016-6316...
Possible XSS Vulnerability in Action View
There is a possible XSS vulnerability in Action View. Text declared as "HTML safe" will not have quotes escaped when used as attribute values in tag helpers. Impact ------ Text declared as "HTML safe" when passed as an attribute value to a tag helper will not have quotes escaped which can lead to...
DEBIAN-CVE-2016-5352
epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service application crash via a crafted packet...
Design/Logic Flaw
drivers/char/diag/diagfwd.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 2013 devices mishandles certain integer values, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28767796 and Qualcomm internal bug CR48340...
Code injection
The telephony component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to cause a denial of service device crash via a NITZ time value of 2038-01-19 or later that is mishandled by the system clock, aka internal bug 29083635,...
spacewalk-monitoring: XSS issue in monitoring probe
A stored cross-site scripting XSS flaw was found in the way spacewalk-java displayed monitoring probes. An attacker can embed HTML and Javascript in the values for RHNMD User or Filesystem parameters in Satellite, allowing them to inject malicious content into the web page that is then displayed...