Debian DSA-3509-1 : rails - security update

Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails. - CVE-2016-2097 Crafted requests to Action View, one of the components of Action Pack, might result in rendering files...

Debian Security Advisory DSA 3509-1 (rails - security update)

Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails. CVE-2016-2097Crafted requests to Action View, one of the components of Action Pack, might result in rendering files fr...

DSA-3509-1 rails - security update

Bulletin has no description...

CVE-2016-0868

Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request...

The vulnerability of the Oracle Database database management system allows a hacker to cause a partial service outage.

The vulnerability of the XML Developer’s Kit component of the Oracle Database management system is related to errors in the code. Exploiting this vulnerability can allow an attacker to cause a partial service failure through HTTP requests via Java Web Start applications or Java applets...

SAP Hostcontrol remote DOS

Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver AS Java 7.0 – 7.5 Vendor URL: SAP Bug: DoS Reported: 01.11.2016 Vendor response: 02.11.2016 Date of Public Advisory: 13.06.2017 Reference: SAP Security Note 2389181 Authors: Mathieu Geli ERPScan VULNERABILITY INFORMATION Class: D...

Apache Camel Java Object Deserialization Vulnerability

Apache Camel is based on the known enterprise-class integration model on the open source integration framework . Camel router , if camel-jetty or camel-servlet used as a consumer , Camel will automatically deserialize HTTP requests using content-header: application/x-java-serialized-object , remo...

Cisco Videoscape Distribution Suite Service Manager REST API Information Disclosure Vulnerability

Cisco Videoscape Distribution Suite Service Manager is an extended and enhanced service manager for content distribution network components. Cisco Videoscape Distribution Suite Service Manager fails to properly handle the target REST API, allowing remote attackers to exploit the vulnerability to...

3S CODESYS Gateway Null Pointer Exception Vulnerability

CODESYS Gateway Server is a software-defined server. A null pointer exception vulnerability exists in CODESYS Gateway Server 2.3.9.47 and earlier versions when processing certain HTTP POST/GET requests. An attacker could exploit this vulnerability to cause a denial of service...

SolarWinds Log and Event Manager Arbitrary Code Execution Vulnerability (CNVD-2015-06703)

SolarWinds Log and Event Manager is a log and event manager that provides real-time log analysis, memory event correlation, and threat attack response. A security vulnerability exists in the command line management console CMC of SolarWinds Log and Event Manager. This allows remote attackers to...

MS15-099: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664)

The remote Windows host has a version of Microsoft Office, Excel, Excel Viewer, SharePoint Server, Microsoft Office Compatibility Pack, Microsoft Office Web Apps, and/or Microsoft SharePoint Foundation installed that is affected by one or more of the following vulnerabilities : - Multiple remote...

Cisco TelePresence Video Communication Server Expressway HTTP GET Request Denial of Service Vulnerability

Cisco TelePresence Video Communication Server is a video conferencing solution that integrates h.323 and SIP. A security vulnerability exists in Cisco TelePresence Video Communication Server Expressway that allows remote users to send special HTTP GET requests for denial of service attacks...

The vulnerability of the Apache HTTP Server web server allows attackers to send hidden http requests.

The vulnerability of the chunked transfer coding mechanism in the Apache HTTP Server exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to send hidden HTTP requests remotely, due to incorrect processing of input values by the...

EasyCTF Unauthorized Access Vulnerability

EasyCTF is a CGI program for scoring CTFs. EasyCTF fails to properly verify session IDs, allowing remote attackers to gain unauthorized access via special HTTP requests...

The vulnerability of Cisco ACS’s microprogramming software allows a remote attacker to execute arbitrary code.

The vulnerability of the ACS View interface allows a remote authenticated user with administrator privileges to execute arbitrary SQL commands using specially crafted HTTPS requests...

USN-2474-1 curl vulnerability

Andrey Labunets discovered that curl incorrectly handled certain URLs when using a proxy server. If a user or automated system were tricked into using a specially crafted URL, an attacker could possibly use this issue to inject arbitrary HTTP requests...

Remote Denial of Service Vulnerability in Multiple IBM Products

IBM Sterling B2B Integration supports an automated, cloud-based approach to transforming business documents into any data format or protocol required and exchanging them with trading partners. A remote denial of service vulnerability exists in multiple IBM products, allowing remote attackers to...

Cisco Enterprise Content Delivery System Web Directory Traversal and Arbitrary File Access Vulnerability

A vulnerability in Cisco Enterprise Content Delivery System ECDS could allow an unauthenticated, remote attacker to conduct directory traversal attacks on a targeted system. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could...

PT-2014-3496 · Red Hat · Red Hat Cloudforms

Name of the Vulnerable Software and Affected Versions: Red Hat CloudForms versions prior to 5.3 Description: The issue allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request. Recommendations: For versions prior to 5.3, update to version 5....

squid: buffer overflow when processing overly long DNS names (SQUID-2013:2)

A buffer overflow flaw was found in Squid's DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid...