MGASA-2017-0017 Updated webmin package fixes security vulnerability

The webmin package has been updated to version 1.831, fixing possible security issues in the Authentic theme fixed in 1.801 and/or 1.810, and containing several other bug fixes and enhancements. See the upstream release announcements and change log for details...

MS14-044: Description of the security update for SQL Server 2012 Service Pack 1 (GDR): August 12, 2014

MS14-044: Description of the security update for SQL Server 2012 Service Pack 1 GDR: August 12, 2014 Introduction A security issue has been identified in Microsoft SQL Server 2012 Service Pack 1 that could allow an attacker to compromise your system and gain control over it. You can help protect...

SUSE-SU-2016:3301-1 Security update for tiff

The tiff library and tools were updated to version 4.0.7 fixing various bug and security issues. - CVE-2014-8127: out-of-bounds read with malformed TIFF image in multiple tools bnc914890 - CVE-2016-9297: tifdirread.c read outside buffer in TIFFPrintField bnc1010161 - CVE-2016-3658: Illegal read i...

Downloads Resources over HTTP

Overview Affected versions of kindlegen insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...

SUSE-SU-2016:2887-1 Security update for java-1_8_0-openjdk

OpenJDK Java was updated to jdk8u111 icedtea 3.2.0 to fix the following issues: Security fixes + S8146490: Direct indirect CRL checks + S8151921: Improved page resolution + S8155968: Update command line options + S8155973, CVE-2016-5542: Tighten jar checks bsc1005522 + S8156794: Extend data shari...

DERAEMON-CMS vulnerable to cross-site scripting

Overview DERAEMON-CMS provided by TEAM DERAEMONS is a content management system CMS. install.php in DERAEMON-CMS contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing of the parameters hostname, database and username. Satoshi Ogawa of Mitsui Bussan Secure Directions, In...

Fedora 24 : jasper (2016-e0f0d48142)

The remote Fedora 24 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2016-e0f0d48142 advisory. This update contains security fix for CVE-2016-8883, CVE-2016-8882, CVE-2016-8881, CVE-2016-8880, CVE-2016-8884, CVE-2016-8885, CVE-2016-8887,...

dhcp security, bug fix, and enhancement update

12:4.2.5-47.0.1 - Added oracle-errwarn-message.patch 12:4.2.5-47 - 1269596 - fix undefined variable in dhclient-script 12:4.2.5-46 - unclosed TCP connections to OMAPI or failover ports can cause DoS CVE-2016-2774 12:4.2.5-45 - 1267489 - dhclient-script does not respect DEFROUTE/GATEWAYDEV patched...

mobiGate App fails to verify SSL server certificates

Overview mobiGate App provided by Nihon Unisys, Ltd. fails to verify SSL server certificates. Gaku Taniguchi of RiskFinder,inc. reported this vulnerability to Nihon Unisys, Ltd., and Nihon Unisys, Ltd. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and...

Cross-Site Scripting

Overview Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag. Proof of Concept var sanitizeHtml = require'sanitize-html'; var dirty = '!/textarea!'; var clean = sanitizeHtmldirty, allowedTags: 'textarea' ; console.logclean; /...

Cross-site scripting vulnerability in WordPress plugin WP-OliveCart

Overview WP-OliveCart provided by Olive Design is a WordPress plugin to construct a shopping site. WP-OliveCart contains cross-site scripting vulnerability. Gen Sato of TRADE WORKS Co.,Ltd Security Dept. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under...

RSS News AutoPilot Script 1.0.1/3.1.0 - Admin Panel Authentication Bypass

Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898 Version: 1.0.1 to 3.1.0...

BLACKBOx - A Penetration Testing Framework

Password Attacks: MD5 CRACKER SHA1 CRACKER SHA224 CRACKER SHA256 CRACKER SHA384 CRACKER SHA512 CRACKER MSSQL2000 CRACKER MSSQL2005 CRACKER MYSQL323 CRACKER MYSQL41 CRACKER ORACLE11 CRACKER Web Hacking : Wordpress Bruteforce – Bruteforce wordpress panel FTP Bruteforce – Bruteforcing FTP LOGIN SSH...

MGASA-2016-0319 Updated php packages fix security vulnerabilities

Memory Corruption in During Deserialized-object Destruction CVE-2016-7411. Heap overflow in mysqlnd related to BIT fields CVE-2016-7412. wddxdeserialize use-after-free CVE-2016-7413. Out of bound when verify signature of zip phar in pharparsezipfile CVE-2016-7414. Missing locale length check in...

MGASA-2016-0321 Updated wireshark packages fix security vulnerabilities

The wireshark package has been updated to version 2.0.6, which fixes several security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...

MyBB < 1.8.7 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

PT-2016-5513 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.5.51 and earlier Oracle MySQL versions 5.6.32 and earlier Oracle MySQL versions 5.7.14 and earlier Description: The issue allows remote authenticated users to affect availability via vectors related to Server: Optimize...

MGASA-2016-0294 Updated webkit2 packages fix security vulnerability

The webkit2 package has been updated to version 2.12.4, fixing several security issues and other bugs...

Moxa OnCell Security Vulnerabilities

OVERVIEW Independent researcher Maxim Rupp has identified authorization bypass and disclosed OS commanding vulnerabilities in Moxa’s OnCell Security Software. Moxa has produced a new version to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS Th...

Fedora 23 : pbuilder (2016-2e20730676)

Update to version 0.225.2, see http://metadata.ftp-master.debian.org/changelogs//main/p/pbuilder/pbui lder0.225.2changelog for details. ---- This update fixes a potential security issue where copy-on-write does not work when used with eatmydata, resulting in persistent filesystem changes. Note th...