CVE-2016-1139

Cross-site request forgery CSRF vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2016-1138

CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors...

CVE-2016-1136

Cross-site scripting XSS vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2016-4394

Name of the Vulnerable Software and Affected Versions OpenStack Object Storage Swift versions prior to 2.4.0 Description The issue allows remote attackers to cause a denial of service by consuming proxy-server resources through a series of interrupted requests to a Large Object URL, due to the...

DEBIAN-CVE-2015-8379

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the method parameter...

BSA-2016-001

Summary Security Advisory ID : BSA-2016-001 Component : Java Revision : 2.0 N/A...

Mozilla Firefox OS lockscreen feature bypass vulnerability

Mozilla Firefox is an open source web browser that uses the Gecko engine. A security vulnerability exists in the lockscreen feature of Mozilla Firefox OS prior to version 2.5, which can be exploited by attackers in close physical proximity to gain access by brute-force password guessing, as the...

UBUNTU-CVE-2015-8400

The HTTPS fallback implementation in Shell In A Box aka shellinabox before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL...

WordPress NEX-Forms Lite Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . NEX-Forms Lite is one of the user-defined plugin to create forms . A cross-site scripting vulnerability exists in...

Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2016-00187)

Symphony CMS is a content management system CMS developed in PHP and MySQL. The system supports search engine optimization, module extensions and more. A cross-site scripting vulnerability exists in the content/content.systempreferences.php script in Symphony CMS versions prior to 2.6.4, which...

Wireshark MP2T File Parser Denial of Service Vulnerability (CNVD-2016-00050)

Wireshark is the most popular network protocol parser. A denial-of-service vulnerability exists in the MP2T file parser in version 2.0.x prior to Wireshark 2.0.1, which allows remote attackers to cause a denial of service stack buffer overflow and application crash via a specially crafted file...

Belkin N600 Spoofing Vulnerability

Belkin N600 is a wireless dual-band router product. Belkin F9K1102 2 device firmware version 2.10.17 uses an incorrect algorithm when selecting the ID value within the DNS query header. This could allow a remote attacker to exploit this vulnerability for response spoofing by predicting the value...

WordPress Plugin Pinpoint Booking System SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Pinpoint Booking System is one of the plugins used to create a booking or reservation system in a WordPress site. A SQL...

The vulnerability of the Firefox browser, which allows a violator to trigger a service failure

The vulnerability of the Firefox browser’s HTTP/2 implementation arises from the loss of a significant number of bits. Exploiting this vulnerability allows an attacker to cause a service failure remotely by triggering a “Assertion failure” error message and a premature termination of the service...

USN-2811-1 strongswan vulnerability

It was discovered that the strongSwan eap-mschapv2 plugin incorrectly handled state. A remote attacker could use this issue to bypass authentication...

Cisco Aironet SSHv2 Handling Denial of Service Vulnerability

Cisco Aironet is a wireless access point product from Cisco. A security vulnerability exists in Cisco Aironet that allows remote attackers to exploit the vulnerability to submit an excessive number of SSHv2 connections, consume a large amount of the device's CPU, and conduct denial of service...

IniNet Solutions SCADA Web Server Path Traversal Vulnerability

IniNet SCADA Web Server is a third-party web-based server software. Versions of SCADA Web Server prior to 2.02 fail to effectively filter certain elements within path names and are implemented with a path traversal vulnerability. An attacker can exploit this vulnerability to read arbitrary OS fil...

PCMan FTP Server Information Disclosure Vulnerability

PCMan FTP Server is FTP server software. A directory traversal vulnerability exists in PCMan FTP Server version 2.0.7, which can be exploited by a remote attacker to read arbitrary files via the RETR command inside the "... /" within the RETR command, this vulnerability can be exploited to read...

httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4

It was discovered that in httpd 2.4, the internal API function apsomeauthrequired could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied...

DEBIAN-CVE-2015-5163

The import task action in OpenStack Image Service Glance 2015.1.x before 2015.1.2 kilo, when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image...