CVE-2015-8761

The vulnerability CVE-2015-8761 affects the Drupal Values module (7.x-1.x) prior to 7.x-1.2. Root cause: insufficient permission checks allow remote administrators with the "Import value sets" permission to run arbitrary PHP code via an exported values list in a ctools import. Impact: potential a...

USN-2861-1: libpng vulnerabilities

It was discovered that libpng incorrectly handled certain small bit-depth values. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with the privileges of the user invoking th...

UBUNTU-CVE-2015-7513

arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service divide-by-zero error and host OS crash via a zero value, related to the kvmvmioctlsetpit and kvmvmioctlsetpit2 functions...

Samba Denial of Service Vulnerability (CNVD-2015-08524)

Samba is a set of programs that implement the SMB Server Messages Block protocol, cross-platform file sharing and print sharing services. A denial-of-service vulnerability exists in Samba version 4.x prior to 4.1.22. Failure to check return values allows remote attackers to cause a...

DEBIAN-CVE-2015-3223

The ldbwildcardcompare function in ldbmatch.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service infinite loop via crafted packets...

Drupal Values Module Arbitrary PHP Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Values is one of the modules used to customize various types of key-value pairs in the backend. An arbitrary PHP code execution vulnerability exists in the Drupal Values module in...

SOL76930736 - Libpng vulnerability CVE-2015-8126

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

[SECURITY] [DSA 3425-1] tryton-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3425-1 [email protected] https://www.debian.org/security/ Luciano Bello December 17, 2015 https://www.debian.org/security/faq -...

Joomla! < 3.4.6 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.4.6. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper sanitization of session values. An unauthenticated,...

Values - Critical - Arbitrary PHP code execution - SA-CONTRIB-2015-172

This module enables you to create key|value pairs for use in list fields, webforms etc. The module includes an import page that runs eval on an exported code block ctools, but the permission for the page does not warn about security concerns of importing raw php code like this trusted permission...

CVE-2015-3223

The ldbwildcardcompare function in ldbmatch.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which allows remote attackers to cause a denial of service infinite loop via crafted packets...

[20151205] - Session - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values which leads to a Remote Code Execution vulnerability...

[20151201] - Core - Remote Code Execution Vulnerability

Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability...

Schneider Electric ProClima F1BookView ActiveX Control CopyRange/SwapTables Methods Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric ProClima. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaws exist within the...

Atlassian JIRA < 6.4.10 / 7.0.0-OD-02 MitM Plaintext Disclosure (Bar Mitzvah)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 6.4.10 or 7.0.0-OD-02. It is, therefore, potentially affected by a security feature bypass vulnerability, known as Bar Mitzvah, due to improper combination of state data with...

The vulnerability of the Microsoft .NET Framework software platform allows a perpetrator to inject arbitrary web or HTML code.

The vulnerability of the ASP.NET software platform, Microsoft .NET Framework, exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject any desired web or HTML code using a specially crafted variable value...

Mageia: Security Advisory (MGASA-2015-0449)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated gcc packages fix security vulnerability

It was discovered that the std::randomdevice class in libstdc++ would not properly detect short reads and could return predictable values if applications used it to obtain randomness from a blocking source such as /dev/random. CVE-2015-5276...

MGASA-2015-0449 Updated gcc packages fix security vulnerability

It was discovered that the std::randomdevice class in libstdc++ would not properly detect short reads and could return predictable values if applications used it to obtain randomness from a blocking source such as /dev/random. CVE-2015-5276...

USN-2815-1 libpng vulnerabilities

Mikulas Patocka discovered that libpng incorrectly handled certain large fields. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause libpng to crash, leading to a denial of service. This issue only affected Ubuntu...