URL Shorteners Put Private Cloud Data at Risk

URL shorteners are convenient, but for a long time gave security practitioners anxiety because it was difficult to determine where the shortened address was taking you. Two researchers have now given you new reasons to fear URL shorteners, especially for those storing and sharing data on...

CVE-2016-1273: Undefined Security Weakness

Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors...

The vulnerability of the Silverlight software platform, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the Silverlight software platform is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially crafted web page...

Code injection

Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified 1 services and 2 files, which allows local users to gain privileges by invalidating local checks...

Linux Kernel (x86) - Disable ASLR by Setting the RLIMIT_STACK Resource to Unlimited

Linux Kernel x86 - Disable ASLR by Setting the RLIMITSTACK Resource to Unlimited Source: http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html CVE-2016-3672 - Unlimiting the stack not longer disables ASLR Authors: Hector Marco & Ismael Ripoll CVE: CVE-2016-3672...

UBUNTU-CVE-2016-3125

The modtls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman DH key to be used and consequently allow attackers to have unspecified impact via unknown vectors...

CVE-2016-1996: Undefined Security Weakness

HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors...

The vulnerability of the SAP NetWeaver software integration platform, which allows a hacker to gain access to protected information

The vulnerability of the Universal Worklist Configuration component of the SAP NetWeaver software integration platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information through a...

The vulnerability of the Moodle learning management system allows a hacker to bypass existing access restrictions.

The vulnerability of the Moodle learning management system’s module selection involves deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions by visiting a specific URL to add or delete answers in a closed state...

The vulnerability of the SAP NetWeaver software integration platform allows a hacker to inject any Web or HTML code.

The vulnerability of the SAP NetWeaver software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code remotely...

The vulnerability of the Moodle learning management system allows a hacker to obtain the user’s password.

The vulnerability of the mtrand function in implementations of randomstring and complexrandomstring of the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user passwords usin...

The vulnerability of the Moodle learning management system allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of the searchpagination function course/classes/managementrenderer.php in the Moodle learning management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code...

Git 版本<=2.7.1 远程代码执行漏洞

参考来源： http://seclists.org/oss-sec/2016/q1/645 Hello, original report describing the overflow is here http://pastebin.com/UX2P2jjg On 11/02/2016 16:50, Jeff King wrote this on the git security mailing list: On Thu, Feb 11, 2016 at 02:31:49PM +0100, 'Laël Cellier' via Git Security wrote: Ok the bug...

Zend Framework < 2.4.9 Encryption Weakness

Binary data 9137.prm...

SUSE SLED11 / SLES11 Security Update : libssh2_org (SUSE-SU-2016:0723-1)

This update for libssh2org fixes the following issues : - Add SHA256 support for DH group exchange fate320343, bsc961964 - fix CVE-2016-0787 bsc967026 - Weakness in diffie-hellman secret key generation lead to much shorter DH groups then needed, which could be used to retrieve server keys. Note...

SUSE-SU-2016:0723-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Add SHA256 support for DH group exchange fate320343, bsc961964 - fix CVE-2016-0787 bsc967026 Weakness in diffie-hellman secret key generation lead to much shorter DH groups then needed, which could be used to retrieve server keys...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information...

Teaching content management system ATutor 2.2.1 injection vulnerability-vulnerability warning-the black bar safety net

Atutor is an open source“content management system”Learning Content Management System, referred to as LCMS。 Using PHP, MySQL, HTTP Web server is recommended to use Apache. Teaching content management system ATutor 2.2.1 injection vulnerability Atutor in addition to teaching content management...

CVE-2016-1640: Undefined Security Weakness

The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623.75 does not block installations upon deletion of an installation frame, which makes it easier for remote attackers to trick a user into believing that an installation request originated from the...

SUSE SLED12 Security Update : libssh (SUSE-SU-2016:0625-1)

This update for libssh fixes the following issues : - CVE-2016-0739: Fix Weakness in diffie-hellman secret key generation. bsc965875 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...