Cisco Firepower Management Center Web Interface Code Injection Vulnerability

A vulnerability in the web interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to modify a page in the web interface. The vulnerability is due to improper sanitization of some parameter values. An attacker could exploit this vulnerability by injecting...

Cisco Firepower Management Center Web Interface Code Injection Vulnerability

A vulnerability in the web interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to modify a page in the web interface. The vulnerability is due to improper sanitization of some parameter values. An attacker could exploit this vulnerability by injecting...

libdwarf Denial of Service Vulnerability

libdwarf is a set of tools for reading and writing DWARF2 debugging information. A security vulnerability exists in libdwarf. An attacker can exploit this vulnerability to cause a denial of service out-of-bounds read and crash with large length values...

Self XSS

PMASA-2016-16 Announcement-ID: PMASA-2016-16 Date: 2016-05-25 Updated: 2016-05-26 Summary Self XSS Description A specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page. Updated to include CVE ID...

SOL95313044 - Multiple Java vulnerabilities

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

CVE-2016-1802

CCCrypt in CommonCrypto in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 mishandles return values during key-length calculations, which allows attackers to obtain sensitive information via a crafted app...

CVE-2016-1209

CVE-2016-1209 affects WordPress Ninja Forms, with vulnerable versions 2.9.36 to 2.9.42 (and 2.9.42.1 as fix variants) allowing remote PHP object injection via crafted POST data, enabling unauthenticated code execution through file upload. Exploitation details are evidenced by Metasploit/Exploit-D...

CVE-2016-1209

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request...

kernel security and bug fix update

3.10.0-327.18.2.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.18.2 - lib keys: Fix ASN.1 indefinite length object parsing David Howells 1308814 1308815 CVE-2016-0758 3.10.0-327.18.1 - scsi bnx2fc: Fix FCP RSP residual parsing Maurizio Lombardi 1322279 1306342 - mm madvise: fix...

Sucuri: CRLF/HTTP header injection www.sucuri.net

I would like to report a security vulnerability on www.sucuri.net. The domain appears to be vulnerable for CRLF or HTTP header injection. This allows attackers to construct a URL that injects HTTP headers in the server's response. One of the things an attacker can do is injecting a "Set-Cookie"...

OpenJDK: incorrect handling of surrogate pairs in XML attribute values (JAXP, 8143167)

It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed...

ThisData: Host Header Poisoning in thisdata.com

ThisData made inappropriate use of the user-supplied host header, which could have resulted in a user being redirected to an arbitrary domain under some circumstances. On other pages, the header was used within metadata values like the canonical URL. 7H0R4PP4N was very thorough and helpful as we...

DEBIAN-CVE-2016-1541

Heap-based buffer overflow in the zipreadmacmetadata function in archivereadsupportformatzip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive...

CVE-2016-1541

Heap-based buffer overflow in the zipreadmacmetadata function in archivereadsupportformatzip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive...

PHP has an unspecified vulnerability (CNVD-2016-02888)

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. PHP allows the use of negative range values, and no detailed vulnerability details are provided at this time...

The vulnerability of the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of the Minikin operating system’s library exists due to the lack of checks for negative values of the font property. Exploiting this vulnerability could allow a local attacker to cause a service failure memory corruption using a specially crafted font...

UBUNTU-CVE-2016-2185

The atiremote2probe function in drivers/input/misc/atiremote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted endpoints value in a USB device descriptor...

UBUNTU-CVE-2016-2187

The gtcoprobe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted endpoints value in a USB device descriptor...

CVE-2016-2813

Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to...

CVE-2016-2813

Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to...