** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
[1034648]
[1034650]
[MS16-001]
[MS16-003]
[20160112 Microsoft Internet Explorer VBScript "Assignvar" Use-After-Free Vulnerability]
Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Microsoft Edge Memory Corruption Vulnerability."
[1034649]
[http://www.zerodayinitiative.com/advisories/ZDI-16-019]
[MS16-002]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability."
[1034648]
[MS16-001]
The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a crafted application, aka "Windows Mount Point Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0007.
[79882]
[1034645]
[MS16-008]
[39311]
The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a crafted application, aka "Windows Mount Point Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0006.
[79898]
[1034645]
[https://code.google.com/p/google-security-research/issues/detail?id=589]
[MS16-008]
[39310]
[39311]
The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows GDI32.dll ASLR Bypass Vulnerability."
[1034654]
[MS16-005]
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via unspecified vectors, aka "Win32k Remote Code Execution Vulnerability."
[1034654]
[MS16-005]
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034651]
[MS16-004]
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.
[1034653]
[MS16-004]
Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."
[1034651]
[MS16-004]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Elevation of Privilege Vulnerability."
[1034661]
[MS16-007]
DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "DirectShow Heap Corruption Remote Code Execution Vulnerability."
[http://packetstormsecurity.com/files/135232/Microsoft-DirectShow-Remote-Code-Execution.html]
[1034660]
[MS16-007]
[39232]
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
[1034661]
[https://code.google.com/p/google-security-research/issues/detail?id=555]
[MS16-007]
[39233]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
[1034661]
[MS16-007]
The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511 allows remote attackers to bypass intended access restrictions and establish sessions for blank-password accounts via a modified RDP client, aka "Windows Remote Desktop Protocol Security Bypass Vulnerability."
[1034659]
[MS16-007]
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "MAPI DLL Loading Elevation of Privilege Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[1034661]
[http://www.zerodayinitiative.com/advisories/ZDI-16-018]
[MS16-007]
Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[84024]
[1035207]
[MS16-029]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0052.
[1034975]
[1034976]
[MS16-015]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Scripting Engine Memory Corruption Vulnerability."
[79891]
[1034649]
[MS16-002]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1036093]
[MS16-070]
The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to gain privileges via a crafted application, aka "Windows Common Log File System Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3332, CVE-2016-3333, CVE-2016-3334, CVE-2016-3335, CVE-2016-3338, CVE-2016-3340, CVE-2016-3342, CVE-2016-3343, and CVE-2016-7184.
[93998]
[1037252]
[MS16-134]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."
[1036106]
[MS16-079]
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.
[79889]
[1034647]
[MS16-010]
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
[79890]
[1034647]
[MS16-010]
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.
[79888]
[1034647]
[MS16-010]
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."
[79884]
[1034647]
[MS16-010]
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of Service Vulnerability."
[1034983]
[MS16-019]
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
[1034655]
[MS16-006]
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034651]
[http://www.zerodayinitiative.com/advisories/ZDI-15-639]
[MS16-004]
The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote authenticated users to execute arbitrary code via crafted data, aka "Remote Desktop Protocol (RDP) Elevation of Privilege Vulnerability."
[1034981]
[MS16-017]
The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data, aka "Microsoft Active Directory Federation Services Denial of Service Vulnerability."
[82507]
[1034984]
[MS16-020]
Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Memory Corruption Vulnerability."
[1034974]
[MS16-013]
Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
[1034975]
[MS16-015]
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
[1034985]
[MS16-014]
[44586]
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[20160210 NPS Datastore server DLL side loading vulnerability]
[1034971]
[1034985]
[MS16-009]
[MS16-014]
[https://www.securify.nl/advisory/SFY20150905/nps_datastore_server_dll_side_loading_vulnerability.html]
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[1034985]
[MS16-014]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted "change batch" data, aka "Windows DLL Loading Denial of Service Vulnerability."
[1034985]
[MS16-014]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file, aka "Microsoft Windows Reader Vulnerability."
[1034973]
[http://www.zerodayinitiative.com/advisories/ZDI-16-156]
[MS16-012]
WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data, aka "Windows Forms Information Disclosure Vulnerability."
[1034983]
[MS16-019]
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
[1034982]
[MS16-018]
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 does not properly validate password changes, which allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action, aka "Windows Kerberos Security Feature Bypass."
[http://packetstormsecurity.com/files/135797/Windows-Kerberos-Security-Feature-Bypass.html]
[82535]
[1034985]
[MS16-014]
[39442]
Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests, aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."
[1034986]
[MS16-021]
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
[1034980]
[MS16-016]
[39432]
[39788]
[40085]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0022.
[1034975]
[1034976]
[MS16-015]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034975]
[1034976]
[MS16-015]
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 SP1, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034976]
[MS16-015]
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034976]
[MS16-015]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1034976]
[MS16-015]
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka "Microsoft Office Security Feature Bypass Vulnerability."
[84030]
[1035207]
[MS16-029]
Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls, aka "Microsoft PDF Library Buffer Overflow Vulnerability."
[1034973]
[MS16-012]
The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information Disclosure Vulnerability."
[1034971]
[MS16-009]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0061, CVE-2016-0063, CVE-2016-0067, and CVE-2016-0072.
[1034971]
[1034972]
[http://www.zerodayinitiative.com/advisories/ZDI-16-159]
[http://www.zerodayinitiative.com/advisories/ZDI-16-165]
[MS16-009]
[MS16-011]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0063, CVE-2016-0067, and CVE-2016-0072.
[1034971]
[1034972]
[http://www.zerodayinitiative.com/advisories/ZDI-16-162]
[MS16-009]
[MS16-011]
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
[1034971]
[1034972]
[http://www.zerodayinitiative.com/advisories/ZDI-16-158]
[MS16-009]
[MS16-011]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0067, and CVE-2016-0072.
[http://blog.skylined.nl/20161128001.html]
[1034971]
[http://www.zerodayinitiative.com/advisories/ZDI-16-166]
[MS16-009]
[40845]
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[1034971]
[MS16-009]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0063, and CVE-2016-0072.
[1034971]
[MS16-009]
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0069.
[1034971]
[MS16-009]
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0068.
[JVN#78383854]
[JVNDB-2016-000028]
[82665]
[1034971]
[MS16-009]
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."
[93354]
[MS16-124]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[1034971]
[MS16-009]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0063, and CVE-2016-0067.
[1034971]
[http://www.zerodayinitiative.com/advisories/ZDI-16-157]
[MS16-009]
The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0075.
[93355]
[MS16-124]
[40574]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0073.
[93356]
[MS16-124]
[40573]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."
[1034971]
[1034972]
[MS16-009]
[MS16-011]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."
[93357]
[MS16-124]
[40608]
Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge ASLR Bypass."
[82631]
[1034972]
[MS16-011]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability."
[82635]
[1034972]
[MS16-011]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
[84032]
[1035209]
[MS16-031]
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."
[1035538]
[MS16-045]
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."
[1035538]
[MS16-045]
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."
[1035538]
[MS16-045]
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0092.
[83944]
[1035208]
[http://www.zerodayinitiative.com/advisories/ZDI-16-182]
[MS16-030]
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0091.
[84125]
[1035208]
[http://www.zerodayinitiative.com/advisories/ZDI-16-181]
[MS16-030]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0094, CVE-2016-0095, and CVE-2016-0096.
[84054]
[1035212]
[MS16-034]
[39648]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0095, and CVE-2016-0096.
[84066]
[1035212]
[MS16-034]
[39647]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0096.
[84072]
[1035212]
[http://www.zerodayinitiative.com/advisories/ZDI-16-196]
[MS16-034]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0095.
[84069]
[1035212]
[MS16-034]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."
[84089]
[1035200]
[MS16-027]
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
[84034]
[1035210]
[MS16-032]
[39574]
[39719]
[39809]
[40107]
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."
[83930]
[1035205]
[MS16-025]
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."
[84111]
[1035200]
[MS16-027]
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.
[84018]
[1035203]
[1035204]
[MS16-023]
[MS16-024]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.
[84013]
[1035203]
[MS16-023]
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[84009]
[1035203]
[MS16-023]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0107, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113.
[84019]
[1035203]
[1035204]
[MS16-023]
[MS16-024]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.
[84014]
[1035203]
[http://www.zerodayinitiative.com/advisories/ZDI-16-179]
[http://www.zerodayinitiative.com/advisories/ZDI-16-180]
[MS16-023]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113.
[84015]
[1035203]
[http://www.zerodayinitiative.com/advisories/ZDI-16-183]
[MS16-023]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0109, and CVE-2016-0114.
[84016]
[1035203]
[MS16-023]
[39562]
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0114.
[84020]
[1035203]
[1035204]
[http://www.zerodayinitiative.com/advisories/ZDI-16-184]
[MS16-023]
[MS16-024]
Microsoft Internet Explorer 10 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
[84021]
[1035203]
[1035204]
[MS16-023]
[MS16-024]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113.
[84022]
[1035203]
[1035204]
[MS16-023]
[MS16-024]
[39663]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0113.
[84010]
[1035203]
[http://www.zerodayinitiative.com/advisories/ZDI-16-185]
[http://www.zerodayinitiative.com/advisories/ZDI-16-188]
[MS16-023]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0112.
[84011]
[1035203]
[http://www.zerodayinitiative.com/advisories/ZDI-16-186]
[MS16-023]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0109.
[84012]
[1035203]
[http://www.zerodayinitiative.com/advisories/ZDI-16-187]
[MS16-023]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0123, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130.
[1035204]
[MS16-024]
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."
[84109]
[1035202]
[MS16-028]
The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."
[84112]
[1035202]
[http://www.zerodayinitiative.com/advisories/ZDI-16-177]
[MS16-028]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Per Microsoft: "For systems running Windows 10, an attacker who successfully exploited the vulnerability could potentially cause the application to stop responding instead of the system."
[84071]
[1035198]
[MS16-026]
[39561]
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
[84027]
[1035198]
[MS16-026]
[39560]
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1035525]
[MS16-042]
[39694]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130.
[84114]
[1035204]
[http://www.zerodayinitiative.com/advisories/ZDI-16-178]
[MS16-024]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0129, and CVE-2016-0130.
[84115]
[1035204]
[MS16-024]
Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Disclosure Vulnerability."
[1035204]
[MS16-024]
Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[89938]
[1035819]
[MS16-054]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1035524]
[1035525]
[MS16-042]
The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."
[http://badlock.org/]
[1035534]
[https://bto.bluecoat.com/security-advisory/sa122]
[MS16-047]
[VU#813296]
[https://www.samba.org/samba/security/CVE-2016-2118.html]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0130.
[84116]
[1035204]
[MS16-024]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0129.
[84117]
[1035204]
[MS16-024]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."
[84075]
[1035213]
[MS16-035]
The USB Mass Storage Class driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows physically proximate attackers to execute arbitrary code by inserting a crafted USB device, aka "USB Mass Storage Elevation of Privilege Vulnerability."
[84035]
[1035211]
[MS16-033]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[84026]
[1035206]
[1035207]
[MS16-029]
The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
[1035541]
[MS16-046]
Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1035524]
[1035525]
[MS16-042]
[20160412 Microsoft Excel Uninitialized Pointer Memory Corruption Vulnerability]
The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft APP-V ASLR Bypass."
[92785]
[1036785]
[MS16-107]
Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."
[92806]
[1036778]
[MS16-108]
Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[1035525]
[MS16-042]
Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[89953]
[1035819]
[MS16-054]
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."
[92903]
[1036785]
[MS16-107]
Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Video Control Remote Code Execution Vulnerability."
[93378]
[1036983]
[MS16-122]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0165 and CVE-2016-0167.
[85896]
[1035529]
[1035532]
[MS16-039]
[39712]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."
[1035528]
[1035529]
[1035530]
[1035531]
[1035532]
[MS16-039]
[39743]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability."
[1035523]
[MS16-040]
Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, aka ".NET Framework Remote Code Execution Vulnerability."
[http://packetstormsecurity.com/files/136671/.NET-Framework-4.6-DLL-Hijacking.html]
[20160412 .NET Framework 4.6 allows side loading of Windows API Set DLL]
[20160412 .NET Framework 4.6 allows side loading of Windows API Set DLL]
[1035535]
[http://www.zerodayinitiative.com/advisories/ZDI-16-234]
[MS16-041]
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."
[90026]
[1035842]
[MS16-065]
HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability."
[1035546]
[MS16-049]
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
[1035544]
[MS16-048]
[39740]
Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."
[90020]
[1035834]
[MS16-058]
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Remote Code Execution Vulnerability."
[1035536]
[MS16-044]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
[1035521]
[1035522]
[MS16-037]
[MS16-038]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0156 and CVE-2016-0157.
[1035522]
[MS16-038]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0157.
[1035522]
[MS16-038]
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0156.
[1035522]
[http://www.zerodayinitiative.com/advisories/ZDI-16-232]
[MS16-038]
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161.
[1035522]
[http://www.zerodayinitiative.com/advisories/ZDI-16-233]
[MS16-038]
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[1035521]
[http://www.zerodayinitiative.com/advisories/ZDI-16-231]
[MS16-037]
Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[http://packetstormsecurity.com/files/136702/Microsoft-Internet-Explorer-11-DLL-Hijacking.html]
[20160416 Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability]
[20160415 Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability]
[1035521]
[MS16-037]
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158.
[1035522]
[MS16-038]
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."
[85939]
[1035521]
[MS16-037]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[85922]
[1035521]
[MS16-037]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.
[1035529]
[1035532]
[MS16-039]
[44480]
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
[1035521]
[http://www.zerodayinitiative.com/advisories/ZDI-16-230]
[MS16-037]
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.
[1035529]
[1035532]
[MS16-039]
GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0169.
[http://packetstormsecurity.com/files/137094/Microsoft-Windows-gdi32.dll-Information-Disclosure.html]
[89862]
[1035823]
[MS16-055]
GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0168.
[http://packetstormsecurity.com/files/137095/Microsoft-Windows-gdi32.dll-Data-Copy.html]
[89863]
[1035823]
[MS16-055]
GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Graphics Component RCE Vulnerability."
[http://packetstormsecurity.com/files/137096/Microsoft-Windows-gdi32.dll-ExtEscape-Buffer-Overflow.html]
[89864]
[1035823]
[MS16-055]
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0173, CVE-2016-0174, and CVE-2016-0196.
[http://packetstormsecurity.com/files/137502/Windows-7-win32k-Bitmap-Use-After-Free.html]
[89860]
[1035841]
[MS16-062]
[39959]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0174, and CVE-2016-0196.
[http://packetstormsecurity.com/files/137503/Windows-7-win32k-Bitmap-Use-After-Free.html]
[90064]
[1035841]
[http://www.zerodayinitiative.com/advisories/ZDI-16-279]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=747]
[MS16-062]
[39960]
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0173, and CVE-2016-0196.
[90065]
[1035841]
[http://www.zerodayinitiative.com/advisories/ZDI-16-280]
[MS16-062]
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses, and consequently bypass the KASLR protection mechanism, via a crafted application, aka "Win32k Information Disclosure Vulnerability."
[90027]
[1035841]
[http://www.zerodayinitiative.com/advisories/ZDI-16-281]
[MS16-062]
dxgkrnl.sys in the DirectX Graphics kernel subsystem in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability."
[90052]
[1035841]
[http://www.zerodayinitiative.com/advisories/ZDI-16-284]
[MS16-062]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The RPC NDR Engine in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles free operations, which allows remote attackers to execute arbitrary code via malformed RPC requests, aka "RPC Network Data Representation Engine Elevation of Privilege Vulnerability."
[90032]
[1035837]
[MS16-061]
Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Shell Remote Code Execution Vulnerability."
[89868]
[1035825]
[MS16-057]
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles symbolic links, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Elevation of Privilege Vulnerability."
[90028]
[1035833]
[MS16-060]
Microsoft Windows 10 Gold and 1511 allows local users to bypass the Virtual Secure Mode Hypervisor Code Integrity (HVCI) protection mechanism and perform RWX markings of kernel-mode pages via a crafted application, aka "Hypervisor Code Integrity Security Feature Bypass."
[90048]
[1035843]
[MS16-066]
Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal (aka .jnt) file, aka "Windows Journal Memory Corruption Vulnerability."
[89867]
[1035824]
[MS16-056]
[20160510 Microsoft Windows Journal OOB Write Memory Corruption Vulnerability]
The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Microsoft Office Graphics RCE Vulnerability."
[1035819]
[MS16-054]
Use-after-free vulnerability in GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Direct3D Use After Free Vulnerability."
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[89892]
[1035823]
[MS16-055]
Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."
[90023]
[1035832]
[http://www.zerodayinitiative.com/advisories/ZDI-16-277]
[MS16-059]
[39805]
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and CVE-2016-0193.
[90008]
[1035821]
[http://www.zerodayinitiative.com/advisories/ZDI-16-338]
[http://www.zerodayinitiative.com/advisories/ZDI-16-355]
[MS16-052]
The Microsoft (1) JScript 5.8 and (2) VBScript 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0189.
[90011]
[1035820]
[MS16-051]
[MS16-053]
The User Mode Code Integrity (UMCI) implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."
[90003]
[1035820]
[MS16-051]
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
[90012]
[1035820]
[MS16-051]
[MS16-053]
[40118]
[https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189/]
Volume Manager Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 does not properly check whether RemoteFX RDP USB disk accesses originate from the user who mounted a disk, which allows local users to read arbitrary files on these disks via RemoteFX requests, aka "Remote Desktop Protocol Drive Redirection Information Disclosure Vulnerability."
[90075]
[1035844]
[MS16-067]
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.
[90010]
[1035821]
[http://www.zerodayinitiative.com/advisories/ZDI-16-282]
[MS16-052]
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
[90007]
[1035820]
[1035821]
[http://www.zerodayinitiative.com/advisories/ZDI-16-276]
[MS16-051]
[MS16-052]
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
[90009]
[1035821]
[http://www.zerodayinitiative.com/advisories/ZDI-16-283]
[MS16-052]
Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
[90004]
[1035820]
[http://www.zerodayinitiative.com/advisories/ZDI-16-275]
[MS16-051]
The Imaging Component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Imaging Component Memory Corruption Vulnerability."
[89901]
[1035823]
[MS16-055]
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0173, and CVE-2016-0174.
[90101]
[1035841]
[http://www.zerodayinitiative.com/advisories/ZDI-16-278]
[MS16-062]
dxgkrnl.sys in the DirectX Graphics kernel subsystem in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability."
[90102]
[1035841]
[MS16-062]
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[89962]
[1035819]
[MS16-054]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and CVE-2016-3211.
[http://packetstormsecurity.com/files/137533/Microsoft-Internet-Explorer-11-Garbage-Collector-Attribute-Type-Confusion.html]
[20160618 CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion]
[20160617 CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion]
[1036096]
[MS16-063]
[39994]
[20160614 Microsoft Internet Explorer 11 Garbage Collector Attribute Type Confusion Vulnerability]
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-3211.
[1036096]
[http://www.zerodayinitiative.com/advisories/ZDI-16-365]
[MS16-063]
GSKit in IBM Security Network Protection 5.3.1 before 5.3.1.7 and 5.3.2 allows remote attackers to discover credentials by triggering an MD5 collision.
[80883]
[1034696]
[http://www-01.ibm.com/support/docview.wss?uid=swg21974242]
A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is possible for an authenticated user to view any task of the current users domain.
[http://www.ibm.com/support/docview.wss?uid=swg2C1000134]
[94578]
A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information associated with actions performed on virtual machines in projects where the user belongs to.
[http://www.ibm.com/support/docview.wss?uid=swg2C1000140]
[94440]
Open redirect vulnerability in IBM Cloud Orchestrator 2.4.x before 2.4.0 FP3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
[93512]
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000124]
A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the system. IBM X-Force ID: 109394.
[ibm-co-cve20160205-info-disc(109394)]
[https://www-01.ibm.com/support/docview.wss?uid=swg2C4000049]
IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL.
[http://www.ibm.com/support/docview.wss?uid=swg2C1000141]
[94656]
IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. IBM X-Force ID: 109399.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981322]
[ibm-algo-cve20160207-clickjacking(109399)]
IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors.
[1035239]
[JR54988]
[http://www-01.ibm.com/support/docview.wss?uid=swg21975774]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF09 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[1034844]
[http://www-01.ibm.com/support/docview.wss?uid=swg21974564]
IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker could send a specially-crafted query to a vulnerable server running to cause the server to disclose sensitive information in the HTTP response.
[http://www.ibm.com/support/docview.wss?uid=swg21981549]
[90527]
IBM DB2 9.7 through FP11, 9.8, 10.1 through FP5, and 10.5 through FP7 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted DRDA message.
[85979]
[1035660]
[IT12462]
[IT12487]
[IT12488]
[IT13350]
[http://www-01.ibm.com/support/docview.wss?uid=swg21979984]
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0213 and CVE-2016-0216.
[http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216]
[http://www.ibm.com/support/docview.wss?uid=swg21975358]
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0212 and CVE-2016-0216.
[http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216]
[http://www.ibm.com/support/docview.wss?uid=swg21975358]
IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file.
[http://www.ibm.com/support/docview.wss?uid=swg21993203]
[94193]
IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database.
[http://www-01.ibm.com/support/docview.wss?uid=swg21979986]
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0212 and CVE-2016-0213.
[http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216]
[http://www.ibm.com/support/docview.wss?uid=swg21975358]
IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
[http://www.ibm.com/support/docview.wss?uid=swg21996417]
[95681]
IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
[95456]
[http://www-01.ibm.com/support/docview.wss?uid=swg21995691]
[http://www-01.ibm.com/support/docview.wss?uid=swg21996417]
XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.
[http://www-01.ibm.com/support/docview.wss?uid=swg21983720]
[ibm-rtc-cve20160219-dos(109693)]
Cross-site scripting (XSS) vulnerability in IBM Cognos TM1, as used in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[91542]
[1036221]
[http://www-01.ibm.com/support/docview.wss?uid=swg21984323]
IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21976949]
Cross-site scripting (XSS) vulnerability in the Webform Framework API in IBM Forms Server 4.0.x, 8.0.x, 8.1, and 8.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110006.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977574]
[ibm-forms-cve20160223-xss(110006)]
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980989]
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive information via unspecified vectors.
[JR54585]
[http://www-01.ibm.com/support/docview.wss?uid=swg21976623]
The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap executable files, which allows local users to gain privileges via a Trojan horse file.
[1035286]
[http://www-01.ibm.com/support/docview.wss?uid=swg21978598]
[http://zerodayinitiative.com/advisories/ZDI-16-208/]
[http://zerodayinitiative.com/advisories/ZDI-16-209/]
[http://zerodayinitiative.com/advisories/ZDI-16-210/]
Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[1035175]
[JR55152]
[http://www-01.ibm.com/support/docview.wss?uid=swg21978058]
IBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in various scripts. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites. IBM X-Force ID: 110236.
[http://www.ibm.com/support/docview.wss?uid=swg22001952]
[97670]
Cross-site scripting (XSS) vulnerability in IBM Marketing Platform 8.6.x and 9.x before 9.1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980989]
IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3, 8.1 through 8.1.0 SP3, 8.2 through 8.2.0 SP2, 8.3 through 8.3.0 SP2, 8.4 through 8.4.0 SP1, and 8.5.0 allows physically proximate attackers to obtain root access via unspecified vectors.
[91535]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1021387]
[MB04021]
[MB04022]
[MB04023]
[MB04024]
[MB04025]
[MB04026]
[MB04027]
[https://delivery04.dhe.ibm.com/sar/CMA/HMA/069vc/2/MH01635.readme.html]
[https://delivery04.dhe.ibm.com/sar/CMA/HMA/069y2/1/MH01636.readme.html]
[https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a1r/2/MH01638.readme.html]
[https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a1v/2/MH01639.readme.html]
[https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a2q/1/MH01640.readme.html]
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs.
[PI56757]
[PI56758]
[PI56759]
[PI56762]
[PI56763]
[PI56764]
[http://www-01.ibm.com/support/docview.wss?uid=swg21976392]
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading README files.
[PI56757]
[PI56758]
[PI56759]
[PI56762]
[PI56763]
[PI56764]
[http://www-01.ibm.com/support/docview.wss?uid=swg21976392]
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980989]
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303.
[http://www-01.ibm.com/support/docview.wss?uid=swg21997687]
[ibm-openpages-cve20160234-info-disc(110303)]
IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems. IBM X-Force ID: 110326.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981748]
[ibm-guardian-cve20160235-info-disc(110326)]
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to execute arbitrary commands with root privileges via the search field.
[93823]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990372]
IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. IBM X-Force ID: 110328.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981631]
[ibm-guardian-cve20160237-info-disc(110328)]
IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409
[http://www.ibm.com/support/docview.wss?uid=swg21989124]
[99379]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/110409]
IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with administrator privileges via unspecified vectors.
[93827]
[http://www-01.ibm.com/support/docview.wss?uid=swg21988999]
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.
[93836]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990232]
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP.
[93828]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990219]
IBM Security Guardium 10.x through 10.1 before p100 allows remote authenticated users to obtain sensitive information by reading an Application Error message.
[93825]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990229]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0244.
Appropriate Vendor Advisory Link: <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21976358">HERE</a>
[100572]
[83488]
[PI54088]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0243.
Appropriate Vendor Advisory Link: <a href="http://www-01.ibm.com/support/docview.wss?uid=swg21976358">HERE</a>
[PI55327]
The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
<a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[PI56682]
Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[93400]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990377]
IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain sensitive cleartext information via unspecified vectors, as demonstrated by password information.
[93341]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990368]
IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors.
[93137]
[http://www-01.ibm.com/support/docview.wss?uid=swg21982031]
SQL injection vulnerability in IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[93339]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990363]
XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977152]
[ibm-infosphere-cve20160250-info-disc(110510)]
IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21985641]
Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110562.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
[ibm-ftm-cve20160253-xss(110562)]
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.
[http://www.ibm.com/support/docview.wss?uid=swg22004036]
[98971]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/110563]
IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564.
[http://www.ibm.com/support/docview.wss?uid=swg22001950]
[98336]
runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.
[1036179]
[http://www-01.ibm.com/support/docview.wss?uid=swg21984561]
Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21984564]
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110604.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981103]
[ibm-curam-cve20160261-xss(110604)]
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977828]
IBM Spectrum Scale 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2 and General Parallel File System 3.5 before 3.5.0.30 allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.
[90525]
[1036458]
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005708]
Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2016:1299]
[SUSE-SU-2016:1300]
[SUSE-SU-2016:1303]
[SUSE-SU-2016:1378]
[SUSE-SU-2016:1379]
[SUSE-SU-2016:1388]
[SUSE-SU-2016:1458]
[SUSE-SU-2016:1475]
[RHSA-2016:0701]
[RHSA-2016:0702]
[RHSA-2016:0708]
[RHSA-2016:0716]
[RHSA-2016:1039]
[1035953]
[IV84035]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980826]
[RHSA-2016:1430]
[RHSA-2017:1216]
IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
[http://www.ibm.com/support/docview.wss?uid=swg21986033]
[95100]
IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
[92150]
[1036467]
[IV86116]
[IV86117]
[IV86118]
[IV86119]
[IV86120]
[IV86132]
[https://aix.software.ibm.com/aix/efixes/security/nettcp_advisory2.asc]
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secure-property information via (1) the server UI or (2) a database request.
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000151]
XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 110915.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
Cross-site scripting (XSS) vulnerability in IBM BigFix Platform 9.x before 9.1.8 and 9.2.x before 9.2.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[91690]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985734]
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.
[96062]
[1037795]
[http://www-01.ibm.com/support/docview.wss?uid=swg21979604]
[http://www-01.ibm.com/support/docview.wss?uid=swg21979669]
[http://www-01.ibm.com/support/docview.wss?uid=swg21979673]
[https://github.com/nonce-disrespect/nonce-disrespect]
[https://support.citrix.com/article/CTX220329]
The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000150]
Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors. IBM X-Force ID: 111052.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
[ibm-ftm-cve20160272-csrf(111052)]
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[94557]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991478]
IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to conduct clickjacking attacks via a crafted web site. IBM X-Force ID: 111076.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
[ibm-ftm-cve20160274-clickjacking(111076)]
IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows local users to obtain sensitive information via vectors related to cacheable HTTPS responses.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object. IBM X-Force ID: 111084.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977245]
[ibm-ftm-cve20160276-code-exec(111084)]
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0278, CVE-2016-0279, and CVE-2016-0301.
[1036091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983292]
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0279, and CVE-2016-0301.
[1036091]
[http://www.talosintelligence.com/reports/TALOS-2016-0090/]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983292]
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0278, and CVE-2016-0301.
[1036091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983292]
Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server Framework and InfoSphere Information Governance Catalog 11.3 before 11.3.1.2, and Information Server Framework and InfoSphere Information Governance Catalog 11.5 before 11.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[92133]
[1036418]
[JR55452]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981766]
The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or FC5899 adapter crash) via crafted packets.
[http://aix.software.ibm.com/aix/efixes/security/mustendd_advisory.asc]
[92193]
[1036481]
[IV80569]
[IV81357]
[IV81459]
[IV82421]
[IV84184]
Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 FP6 IF2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYHAAHNUS.
[94558]
[1037383]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991722]
Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[1035330]
[PI58003]
[http://www-01.ibm.com/support/docview.wss?uid=swg21978293]
The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[94555]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991478]
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted field.
[94550]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991478]
IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote authenticated users to obtain administrator passwords by leveraging unspecified privileges. BM X-Force ID: 111234.
[http://www-01.ibm.com/support/docview.wss?uid=swg21986852]
[ibm-tivoli-cve20160286-info-disc(111234)]
IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors.
[91706]
[http://www-01.ibm.com/support/docview.wss?uid=nas8N1021418]
[SI60523]
[https://www.tenable.com/security/research/tra-2016-18]
IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
<a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[1035927]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980055]
shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21979519]
IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302.
[http://www-01.ibm.com/support/docview.wss?uid=swg21985748]
[ibm-mdm-cve20160291-command-injection(111302)]
WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a report.
[http://www-01.ibm.com/support/docview.wss?uid=swg21985907]
Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file.
[92593]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985743]
Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363.
[http://www-01.ibm.com/support/docview.wss?uid=swg21985830]
[ibm-mdm-cve20160295-csrf(111363)]
IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.
[http://www.ibm.com/support/docview.wss?uid=swg21993213]
[94213]
IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques.
[http://www.ibm.com/support/docview.wss?uid=swg21993214]
[94188]
Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary files via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981749]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to obtain sensitive information via vectors involving a database query. IBM X-Force ID: 111382.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981155]
[ibm-tririga-cve20160299-info-disc(111382)]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. IBM X-Force ID: 111412.
[http://www-01.ibm.com/support/docview.wss?uid=swg21979760]
[ibm-tririga-cve20160300-sec-bypass(111412)]
Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0278, and CVE-2016-0279.
[1036091]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983292]
Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981591]
The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.
[http://www-01.ibm.com/support/docview.wss?uid=swg21983328]
IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
[http://www.ibm.com/support/docview.wss?uid=swg21986770]
[92436]
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
[85978]
[PI56190]
[http://www-01.ibm.com/support/docview.wss?uid=swg21979231]
IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.
[http://www.ibm.com/support/docview.wss?uid=swg21986770]
[92440]
IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.
[http://www.ibm.com/support/docview.wss?uid=swg21986770]
[92439]
IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain.
[http://www.ibm.com/support/docview.wss?uid=swg21988338]
[92437]
Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111480.
[http://www-01.ibm.com/support/docview.wss?uid=swg21986853]
[ibm-tivoli-cve20160311-xss(111480)]
[https://www.ibm.com/blogs/psirt/ibm-security-bulletin-cross-site-scripting-vulnerability-in-tivoli-business-service-manager-cve-2016-0311/]
IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to Document Manager. IBM X-Force ID: 111486.
[http://www-01.ibm.com/support/docview.wss?uid=swg21979762]
[ibm-tririga-cve20160312-info-disc(111486)]
Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2888 and CVE-2016-0350.
[http://www-01.ibm.com/support/docview.wss?uid=swg21983147]
The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allow remote authenticated users to conduct clickjacking attacks via unspecified vectors.
[91697]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983147]
The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation.
[http://www-01.ibm.com/support/docview.wss?uid=swg21983147]
Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[92472]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983137]
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
[92463]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983137]
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation.
[92466]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983137]
The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[92475]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983137]
IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes.
[http://www.ibm.com/support/docview.wss?uid=swg2C1000222]
[95974]
IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.
[91751]
[IT12006]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981692]
Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document.
[LO88783]
[http://www-01.ibm.com/support/docview.wss?uid=swg21982611]
The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to disable X.509 certificate validation, and consequently bypass an intended HTTPS trust-management feature, via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21979682]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges via unspecified vectors. IBM X-Force ID: 111640.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981438]
[ibm-spim-cve20160324-command-injection(111640)]
IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allow remote authenticated users to execute arbitrary OS commands via a crafted request.
[94539]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991478]
IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1 ifix3 allow remote authenticated users to execute arbitrary OS commands via a crafted "HTML request."
[93824]
[http://www-01.ibm.com/support/docview.wss?uid=swg21989735]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges via unspecified vectors. IBM X-Force ID: 111643.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981438]
[ibm-sim-cve20160327-command-injection(111643)]
IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain administrator privileges for command execution via unspecified vectors.
[93402]
[http://www-01.ibm.com/support/docview.wss?uid=swg21990226]
Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 before 10.0.4.0_iFix8, and 10.1.0.0 before 10.1.0.0_iFix3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 111692.
[http://www-01.ibm.com/support/docview.wss?uid=swg21982629]
[ibm-emptoris-cve20160329-url-redirect(111692)]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles password creation, which makes it easier for remote attackers to obtain access by leveraging an attack against the password algorithm.
[1036255]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985736]
Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 6.0.1 and 6.0.2 before 6.0.2 iFix2 and Rational Collaborative Lifecycle Management 6.0.1 and 6.0.2 before 6.0.2 iFix2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[92840]
[1036814]
[http://www-01.ibm.com/support/docview.wss?uid=swg21989899]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach. IBM X-Force ID: 111695.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981438]
[ibm-sim-cve20160332-brute-force(111695)]
Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. IBM X-Force ID: 111736.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981438]
[ibm-sim-cve20160335-csrf(111736)]
Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981438]
[ibm-sim-cve20160336-xss(111737)]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cleartext passwords by (1) reading a configuration file or (2) examining a process.
[1036255]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985736]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which makes it easier for remote attackers to spoof users by leveraging knowledge of "traffic records."
[91689]
[1036255]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985736]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation.
[91692]
[1036255]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985736]
IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 through 1.0.0.4 do not require HTTPS, which might allow remote attackers to obtain sensitive information by sniffing the network.
[IT14835]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981462]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary reports by leveraging an incorrect grant of access. IBM X-Force ID: 111783.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980252]
[ibm-tririga-cve20160342-info-disc(111783)]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain sensitive information by reading an error message. IBM X-Force ID: 111784.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980229]
[ibm-tririga-cve20160343-info-disc(111784)]
Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111785.
[ibm-tririga-cve20160344-xss(111785)]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980234]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain the installation path via vectors involving Birt report rendering. IBM X-Force ID: 111786.
[ibm-tririga-cve20160345-info-disc(111786)]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980233]
Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[85864]
[1036221]
[http://www-01.ibm.com/support/docview.wss?uid=swg21984323]
Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111813.
[http://www-01.ibm.com/support/docview.wss?uid=swg21980237]
[ibm-tririga-cve20160348-csrf(111813)]
IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call.
[1036185]
[JR55701]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981094]
Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2888 and CVE-2016-0313.
[http://www-01.ibm.com/support/docview.wss?uid=swg21983147]
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890.
[http://www-01.ibm.com/support/docview.wss?uid=swg21989198]
[ibm-sim-cve20160351-info-disc(111890)]
IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[94543]
[http://www-01.ibm.com/support/docview.wss?uid=swg21988706]
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.
[http://www.ibm.com/support/docview.wss?uid=swg22006439]
[100599]
[1039231]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/111893]
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111894.
[http://www.ibm.com/support/docview.wss?uid=swg22006439]
[100599]
[1039231]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/111894]
IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895.
[http://www.ibm.com/support/docview.wss?uid=swg22006439]
[100599]
[1039231]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/111895]
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduct clickjacking attacks via a crafted web site.
[87528]
[1036255]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985736]
IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM X-Force ID: 111928.
[http://www.ibm.com/support/docview.wss?uid=swg22006441]
[100572]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/111928]
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
<a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[91484]
[1036184]
[PI58918]
[http://www-01.ibm.com/support/docview.wss?uid=swg21982526]
IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference #: 1983457.
[95317]
[1037561]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983457]
IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with DB2 on Linux, UNIX and Windows, allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by discovering ADMIN passwords.
[90550]
[1036455]
[http://www-01.ibm.com/support/docview.wss?uid=swg21986595]
IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet or Internet hosts, via a crafted proxy request to a web service.
<a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a>
[http://www-01.ibm.com/support/docview.wss?uid=swg21980749]
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
[SUSE-SU-2016:1299]
[SUSE-SU-2016:1300]
[SUSE-SU-2016:1303]
[SUSE-SU-2016:1378]
[SUSE-SU-2016:1379]
[SUSE-SU-2016:1388]
[SUSE-SU-2016:1458]
[SUSE-SU-2016:1475]
[RHSA-2016:0701]
[RHSA-2016:0702]
[RHSA-2016:0708]
[RHSA-2016:0716]
[RHSA-2016:1039]
[20160405 Re: [SE-2012-01] Broken security fix in IBM Java 7/8]
[20160404 [SE-2012-01] Broken security fix in IBM Java 7/8]
[http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf]
[85895]
[1035953]
[IX90172]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980826]
[RHSA-2016:1430]
[RHSA-2017:1216]
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000152]
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows remote attackers to bypass authentication and obtain sensitive artifact information via unspecified vectors.
[91526]
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000149]
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 112071.
[http://www-01.ibm.com/support/docview.wss?uid=swg21986260]
[ibm-sim-cve20160366-weak-security(112071)]
IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive information by reading an error message. IBM X-Force ID: 112072.
[http://www-01.ibm.com/support/docview.wss?uid=swg21989198]
[ibm-sim-cve20160367-info-disc(112072)]
XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 112088.
[http://www-01.ibm.com/support/docview.wss?uid=swg21988727]
[ibm-forms-cve20160369-info-disc(112088)]
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
[92471]
[LO88449]
[LO88451]
[http://www-01.ibm.com/support/docview.wss?uid=swg21988726]
The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.
[94148]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985114]
IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[94541]
[http://www-01.ibm.com/support/docview.wss?uid=swg21991478]
IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.
[http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219]
[ibm-ucd-cve20160373-info-disc(112119)]
The builder tools in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981729]
JMS Client in IBM MessageSight 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21985064]
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
<a href="http://cwe.mitre.org/data/definitions/502.html" rel="nofollow">CWE-502: Deserialization of Untrusted Data</a>
[SUSE-SU-2016:1299]
[SUSE-SU-2016:1300]
[SUSE-SU-2016:1303]
[SUSE-SU-2016:1378]
[SUSE-SU-2016:1379]
[SUSE-SU-2016:1388]
[SUSE-SU-2016:1458]
[SUSE-SU-2016:1475]
[RHSA-2016:0701]
[RHSA-2016:0702]
[RHSA-2016:0708]
[RHSA-2016:0716]
[RHSA-2016:1039]
[20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8]
[http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf]
[20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8]
[89192]
[1035953]
[IX90171]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980826]
[RHSA-2016:1430]
[RHSA-2017:1216]
The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
[92514]
[1036653]
[http://www-01.ibm.com/support/docview.wss?uid=swg21980645]
IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.
[93143]
[PI54459]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981529]
IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by leveraging queue-manager rights.
[93146]
[http://www-01.ibm.com/support/docview.wss?uid=swg21984565]
IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.
[92336]
[IT14769]
[http://www-01.ibm.com/support/docview.wss?uid=swg21988278]
IBM Cognos TM1 10.2.2 before FP5, when the host/pmhub/pm/admin AdminGroups setting is empty, allows remote authenticated users to cause a denial of service (configuration outage) via a non-empty value.
[1035930]
[http://www-01.ibm.com/support/docview.wss?uid=swg21981936]
The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. IBM X-Force ID: 112356.
[http://www.ibm.com/support/docview.wss?uid=swg22000590]
[98301]
Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
[92505]
[1036654]
[PI60026]
[http://www-01.ibm.com/support/docview.wss?uid=swg21982588]
Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees.
[IV83657]
Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2883.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981740]
Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
[91515]
[PI62052]
[http://www-01.ibm.com/support/docview.wss?uid=swg21982012]
Cross-site scripting (XSS) vulnerability in IBM Algorithmics Algo One Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21981321]
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
[http://www-01.ibm.com/support/docview.wss?uid=swg21982615]
IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.
[http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html]
[20160607 [CVE-2016-0392] IBM GPFS / Spectrum Scale Command Injection]
[91082]
[1036458]
[http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875]
[IV84206]
IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL information by reading log files.
[91744]
[http://www-01.ibm.com/support/docview.wss?uid=swg21986053]
IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.
[http://www.ibm.com/support/docview.wss?uid=swg21985013]
[94577]
IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.
[http://www.ibm.com/support/docview.wss?uid=swg21993206]
[94155]
WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.
[92467]
[http://www-01.ibm.com/support/docview.wss?uid=swg21985907]
IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21977070]
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21984134]
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
<a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[PI60897]
[PI60898]
[http://www-01.ibm.com/support/docview.wss?uid=swg21983036]
[40039]
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown vectors related to Scheduler, a different vulnerability than CVE-2016-0429.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[SUSE-SU-2016:0256]
[openSUSE-SU-2016:0263]
[SUSE-SU-2016:0265]
[openSUSE-SU-2016:0268]
[SUSE-SU-2016:0269]
[openSUSE-SU-2016:0270]
[openSUSE-SU-2016:0272]
[openSUSE-SU-2016:0279]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0053]
[RHSA-2016:0054]
[RHSA-2016:0055]
[RHSA-2016:0056]
[RHSA-2016:0057]
[RHSA-2016:0067]
[DSA-3458]
[DSA-3465]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[81096]
[1034715]
[USN-2884-1]
[USN-2885-1]
[RHSA-2016:1430]
[GLSA-201603-14]
[GLSA-201610-08]
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to SMB Utilities.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.2.2 allows remote attackers to affect integrity via vectors related to Admin.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect confidentiality via vectors related to Cluster Manageability and Serviceability.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via vectors related to Libc.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 through 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to the Activity Guide sub-component.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1 and 11.2.0.4 allows local users to affect confidentiality, integrity, and availability via vectors related to Agent Next Gen.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the PeopleSoft Enterprise SCM eProcurement component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect integrity via unknown vectors related to Manage Requisition Status.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.1.7 allows remote authenticated users to affect integrity via vectors related to Federation protocol support.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0418.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to UI Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect integrity via unknown vectors related to System Archive Utility.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.2 allows local users to affect confidentiality, integrity, and availability via vectors related to HA for MySQL.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0414.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0431.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via unknown vectors related to Monitoring and Diagnostics.
[http://packetstormsecurity.com/files/138509/JD-Edwards-9.1-EnterpriseOne-Server-Create-Users.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-011: JD Edwards Server Manager Create users]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
[https://www.onapsis.com/research/security-advisories/jd-edwards-server-manager-create-user]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Monitoring and Diagnostics SEC.
[http://packetstormsecurity.com/files/138508/JD-Edwards-9.1-EnterpriseOne-Server-Manager-Shutdown.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-010: JD Edwards Server Manager Shutdown]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
[https://www.onapsis.com/research/security-advisories/jd-edwards-server-manager-shutdown]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0424.
[http://packetstormsecurity.com/files/138507/JD-Edwards-9.1-EnterpriseOne-Server-JDENet-Password-Disclosure.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-009: JD Edwards JDENet Password Disclosure]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
[https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-password-disclosure]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Enterprise Infrastructure SEC.
[http://packetstormsecurity.com/files/138512/JD-Edwards-9.1-EnterpriseOne-Server-JDENET-Denial-Of-Service.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-014: JD Edwards JDENET function DoS]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
[https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-end-file-dos]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0422.
[http://packetstormsecurity.com/files/138510/JD-Edwards-9.1-EnterpriseOne-Server-Denial-Of-Service.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-012: JD Edwards JDENET function DoS]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
[https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-type-8-dos]
Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Monitoring and Diagnostics.
[http://packetstormsecurity.com/files/138511/JD-Edwards-9.1-EnterpriseOne-Server-Password-Disclosure.html]
[20160825 Onapsis Security Advisory ONAPSIS-2016-00171: JD Edwards Server Manager Password Disclosure]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034722]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality and availability via unknown vectors related to Solaris Kernel Zones.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Verified Boot.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown vectors related to Scheduler, a different vulnerability than CVE-2016-0401.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support, a different vulnerability than CVE-2016-0439.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0419.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6014, and CVE-2015-6015.
Per Oracle: Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0436, CVE-2016-0437, and CVE-2016-0438.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality and integrity via vectors related to Mobile POS.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0437, and CVE-2016-0438.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0436, and CVE-2016-0438.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0434, CVE-2016-0436, and CVE-2016-0437.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support, a different vulnerability than CVE-2016-0430.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to NFSv4.
Per Oracle: Unsupported Solaris 11.x versions should be upgraded to a supported release or patch set. Refer to the Critical Patch Update January 2015 Patch Availability Document for Oracle Sun Systems Products Suite.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Embedded Server.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034712]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Loader Service.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality via unknown vectors related to Agent Next Gen.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0447 and CVE-2016-0449.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality via unknown vectors related to Agent Next Gen.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0449.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.
Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[SUSE-SU-2016:0256]
[openSUSE-SU-2016:0263]
[SUSE-SU-2016:0265]
[openSUSE-SU-2016:0268]
[SUSE-SU-2016:0269]
[openSUSE-SU-2016:0270]
[openSUSE-SU-2016:0272]
[openSUSE-SU-2016:0279]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0053]
[RHSA-2016:0054]
[RHSA-2016:0055]
[RHSA-2016:0056]
[RHSA-2016:0057]
[RHSA-2016:0067]
[DSA-3458]
[DSA-3465]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[81123]
[1034715]
[USN-2884-1]
[USN-2885-1]
[RHSA-2016:1430]
[GLSA-201603-14]
[GLSA-201610-08]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0447.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81117]
[http://www.zerodayinitiative.com/advisories/ZDI-16-021]
[https://redr2e.com/cve-to-poc-cve-2016-0450/]
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0452.
Per Oracle: The CVSS score is 10.0 only on Windows for Database versions prior to 12c. The CVSS is 7.5 (Confidentiality, Integrity and Availability is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81125]
[http://www.zerodayinitiative.com/advisories/ZDI-16-022]
[https://redr2e.com/cve-to-poc-cve-2016-0451/]
Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0451.
Per Oracle: The CVSS score is 10.0 only on Windows for Database versions prior to 12c. The CVSS is 7.5 (Confidentiality, Integrity and Availability is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81122]
[http://www.zerodayinitiative.com/advisories/ZDI-16-023]
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote attackers to affect integrity via unknown vectors related to Embedded Server.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034712]
Unspecified vulnerability in the Oracle Mobile Application Servlet component in Oracle E-Business Suite 12.1 and 12.2 allows local users to affect confidentiality via vectors related to MWA Server Manager.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality and availability via unknown vectors related to Agent Next Gen.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034734]
Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/copxmllcmservicecontroller.js.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
[https://erpscan.io/advisories/erpscan-16-006-oracle-e-business-suite-xxe-injection-vulnerability/]
Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
[https://erpscan.io/advisories/erpscan-16-007-oracle-e-business-suite-xxe-injection-vulnerability/]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via vectors related to Kernel DAX.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect integrity via unknown vectors related to Popup Windows.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.55 allows remote attackers to affect integrity via unknown vectors related to Fluid Homepage and NavBar.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034709]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via unknown vectors related to Multichannel Framework, a different vulnerability than CVE-2015-2650.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality via unknown vectors related to Portal.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to WLS-Console.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81185]
[1034716]
Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect availability via unknown vectors related to Resource Group Manager.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.
Per Oracle: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
[SUSE-SU-2016:0256]
[openSUSE-SU-2016:0263]
[SUSE-SU-2016:0265]
[openSUSE-SU-2016:0268]
[SUSE-SU-2016:0269]
[openSUSE-SU-2016:0270]
[openSUSE-SU-2016:0272]
[openSUSE-SU-2016:0279]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0053]
[RHSA-2016:0054]
[RHSA-2016:0055]
[RHSA-2016:0056]
[RHSA-2016:0057]
[RHSA-2016:0067]
[DSA-3458]
[DSA-3465]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[81118]
[1034715]
[USN-2884-1]
[USN-2885-1]
[RHSA-2016:1430]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10148]
[GLSA-201603-14]
[GLSA-201610-08]
Unspecified vulnerability in the Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034709]
Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035618]
Unspecified vulnerability in the Oracle Retail MICROS C2 component in Oracle Retail Applications 9.89.0.0 allows local users to affect confidentiality via vectors related to POS.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035600]
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to BI Publisher Security.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via unknown vectors related to Multichannel Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034709]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via unknown vectors related to Fluid Core.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
Per Oracle: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
[SUSE-SU-2016:0256]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0055]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[1034715]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10148]
[GLSA-201610-08]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0477 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81199]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-045]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the (1) repository, (2) workspace, or (3) scenario parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81153]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-041]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0477. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptName parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81163]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-036]
Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality and integrity via vectors related to Analytics Scorecard.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035618]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0481, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the TMAPReportImage parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81070]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-043]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scheduleReportName parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81097]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-044]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81100]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-037]
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.
Per Oracle: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
[SUSE-SU-2016:0256]
[openSUSE-SU-2016:0263]
[SUSE-SU-2016:0265]
[openSUSE-SU-2016:0268]
[SUSE-SU-2016:0269]
[openSUSE-SU-2016:0270]
[openSUSE-SU-2016:0272]
[openSUSE-SU-2016:0279]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0053]
[RHSA-2016:0054]
[RHSA-2016:0055]
[RHSA-2016:0056]
[RHSA-2016:0057]
[RHSA-2016:0067]
[DSA-3458]
[DSA-3465]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[1034715]
[USN-2884-1]
[USN-2885-1]
[http://www.zerodayinitiative.com/advisories/ZDI-16-032]
[RHSA-2016:1430]
[GLSA-201603-14]
[GLSA-201610-08]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptPath parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81102]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-034]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81105]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-046]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0485. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the exportFileName parameter.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81107]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-040]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0490. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the process method in the ActionServlet servlet, which allows remote attackers to bypass authentication via directory traversal sequences following an unspecified URI string.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81124]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-033]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0492. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function in the admin pages, which allows remote attackers to bypass authentication and gain administrator access via directory traversal sequences following a URI entry that does not require authentication.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81104]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-035]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81184]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-038]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0487. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the UploadServlet servlet, which allows remote attackers to upload and execute arbitrary files via directory traversal sequences in a filename header.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81173]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-039]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
[http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload]
[81169]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-047]
[39691]
[39852]
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.
[http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload]
[81158]
[1034734]
[http://www.zerodayinitiative.com/advisories/ZDI-16-042]
[39691]
[39852]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via unknown vectors related to Kernel Cryptography.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.
[SUSE-SU-2016:0256]
[openSUSE-SU-2016:0263]
[SUSE-SU-2016:0265]
[openSUSE-SU-2016:0268]
[SUSE-SU-2016:0269]
[openSUSE-SU-2016:0270]
[openSUSE-SU-2016:0272]
[openSUSE-SU-2016:0279]
[RHSA-2016:0049]
[RHSA-2016:0050]
[RHSA-2016:0053]
[RHSA-2016:0054]
[RHSA-2016:0055]
[RHSA-2016:0056]
[RHSA-2016:0057]
[RHSA-2016:0067]
[DSA-3458]
[DSA-3465]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[1034715]
[USN-2884-1]
[USN-2885-1]
[RHSA-2016:1430]
[GLSA-201603-14]
[GLSA-201610-08]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.
[DSA-3454]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81214]
[1034731]
Unspecified vulnerability in the MICROS CWDirect component in Oracle Retail Applications 12.5, 13.0, 14.0, 15.0, 16.0, 17.0, and 18.0 allows remote attackers to affect confidentiality via unknown vectors related to Order Entry.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows remote attackers to affect integrity via unknown vectors related to Web Client.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034727]
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows local users to affect confidentiality via unknown vectors related to Install.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034727]
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4794.
Per Oracle: The CVSS score is 9.0 only on Windows for Database versions prior to 12c. The CVSS is 6.5 (Confidentiality, Integrity and Availability is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034709]
Unspecified vulnerability in the Oracle Retail Order Broker Cloud Service component in Oracle Retail Applications 4.0 and 4.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to System Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.2 allows remote attackers to affect availability via vectors related to SGD Core.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034729]
Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034708]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81126]
[1034708]
[USN-2881-1]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81077]
[1034708]
[USN-2881-1]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81088]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in the Oracle Retail Order Management System Cloud Service component in Oracle Retail Applications 3.5, 4.5, 4.7, 5.0, and 15.0 allows remote attackers to affect confidentiality via unknown vectors related to Order Entry.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle iReceivables component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to AR Web Utilities, a different vulnerability than CVE-2016-0519.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034717]
Unspecified vulnerability in the Oracle Internet Expenses component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to AP Web Utilities.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Business Views Catalog.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Components, a different vulnerability than CVE-2016-0547, CVE-2016-0548, and CVE-2016-0549.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Self Service - Common Modules.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0515.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0514.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Quality component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to QA / Order Management Integration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to General utilities, a different vulnerability than CVE-2016-0518.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to General utilities, a different vulnerability than CVE-2016-0517.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle iReceivables component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to AR Web Utilities, a different vulnerability than CVE-2016-0507.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to Java APIs.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle iProcurement component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Redirection.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Retail Open Commerce Platform Cloud Service component in Oracle Retail Applications 3.5, 4.5, 4.7, and 5.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034718]
Unspecified vulnerability in the Oracle Interaction Blending component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Blending Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Work Provider Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Work Provider Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via unknown vectors related to Wireless Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0528, CVE-2016-0529, and CVE-2016-0530.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0529, and CVE-2016-0530.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0528, and CVE-2016-0530.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0528, and CVE-2016-0529.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Oracle Diagnostics Interfaces.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security Assignments.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Messaging.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Project Contracts component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Printing.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect availability via vectors related to RPC.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to error messages.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Person.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Financial Consolidation Hub component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Business Intelligence.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors related to UI Servlet, a different vulnerability than CVE-2016-0541.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034727]
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors related to UI Servlet, a different vulnerability than CVE-2016-0540.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034727]
Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via unknown vectors related to Field Service Map.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Preview.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Architecture.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0551, CVE-2016-0552, CVE-2016-0559, and CVE-2016-0560.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81066]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://bugzilla.redhat.com/show_bug.cgi?id=1301493]
[https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-47.html]
[https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-28.html]
[https://github.com/mysql/mysql-server/commit/0dbd5a8797ed4bd18e8b883988fb62177eb0f73f]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Components, a different vulnerability than CVE-2016-0511, CVE-2016-0548, and CVE-2016-0549.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Components, a different vulnerability than CVE-2016-0511, CVE-2016-0547, and CVE-2016-0549.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Components, a different vulnerability than CVE-2016-0511, CVE-2016-0547, and CVE-2016-0548.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to CRM HTML Administration.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0552, CVE-2016-0559, and CVE-2016-0560.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0559, and CVE-2016-0560.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Interaction Center Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Business Intelligence.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CADView-3D component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Studio.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Administration, a different vulnerability than CVE-2016-0557.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Administration, a different vulnerability than CVE-2016-0556.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Renewals.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0552, and CVE-2016-0560.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0552, and CVE-2016-0559.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0564.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Common Applications component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via vectors related to CRM User Management Framework.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Techstack.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0561.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality via unknown vectors related to Deliverables.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Embedded Data Warehouse.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Email Center component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Server Components.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Balanced Scorecard component in Oracle E-Business Suite 11.5.10.2 and 12.1 allows remote attackers to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034716]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81085]
[1034716]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0577.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81080]
[1034716]
Unspecified vulnerability in the Oracle Learning Management component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to OTA Self Service.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to ICX LOVs.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0574.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81116]
[1034716]
Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0582, CVE-2016-0583, and CVE-2016-0584.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Approvals Management component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to AME Page rendering.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0583, and CVE-2016-0584.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0582, and CVE-2016-0584.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0582, and CVE-2016-0583.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via vectors related to ICX Error.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to iHelp.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality via unknown vectors related to File Processing.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the Oracle General Ledger component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Consolidation Hierarchy Viewer.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034726]
Unspecified vulnerability in the PeopleSoft Enterprise SCM Order Management component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect integrity via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034720]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affect availability via unknown vectors related to Core.
[DSA-3454]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81224]
[1034731]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034708]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81121]
[1034708]
[USN-2881-1]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81130]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81151]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81182]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034708]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81188]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034708]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."
[20160210 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[20160205 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox]
[1034731]
Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."
[20160210 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox]
[http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html]
[20160205 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox]
[83008]
[1034969]
[GLSA-201610-08]
[https://security.netapp.com/advisory/ntap-20160217-0001/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81253]
[1034708]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81238]
[1034708]
[USN-2881-1]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81226]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81258]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81198]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-1019-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[openSUSE-SU-2016:0367]
[openSUSE-SU-2016:0377]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[81164]
[1034708]
[USN-2881-1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034711]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3453]
[DSA-3459]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[81176]
[1034708]
[USN-2881-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/]
[https://mariadb.com/kb/en/mdb-10023-rn/]
Unspecified vulnerability in the kernel-uek component in Oracle Linux 6 allows local users to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[1034968]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality via unknown vectors related to Zones.
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[1034735]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect integrity via vectors related to the Automated Installer sub-component.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035629]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
[RHSA-2017:0725]
[[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME]
[92999]
[RHSA-2017:1931]
[https://bugzilla.redhat.com/show_bug.cgi?id=1377613]
[GLSA-201612-39]
Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[91787]
[91869]
[1036377]
[1036378]
[1036393]
[1036397]
[1037640]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.
[SUSE-SU-2016:0956]
[SUSE-SU-2016:0957]
[SUSE-SU-2016:0959]
[openSUSE-SU-2016:0971]
[openSUSE-SU-2016:0983]
[openSUSE-SU-2016:1004]
[openSUSE-SU-2016:1005]
[openSUSE-SU-2016:1042]
[RHSA-2016:0511]
[RHSA-2016:0512]
[RHSA-2016:0513]
[RHSA-2016:0514]
[RHSA-2016:0515]
[RHSA-2016:0516]
[DSA-3558]
[http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-2949497.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[85376]
[1035401]
[USN-2942-1]
[GLSA-201606-18]
[GLSA-201610-08]
[https://security.netapp.com/advisory/ntap-20160328-0001/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035615]
[https://www.tenable.com/security/research/tra-2016-09]
Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.
[openSUSE-SU-2016:1332]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86418]
[1035606]
[USN-2953-1]
[USN-2954-1]
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86427]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86470]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[DSA-3557]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86445]
[1035606]
[USN-2953-1]
[USN-2954-1]
[RHSA-2016:1132]
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86486]
[1035606]
[USN-2953-1]
[USN-2954-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86442]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86436]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86495]
[1035606]
[USN-2953-1]
[USN-2954-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86457]
[1035606]
[USN-2953-1]
[USN-2954-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86498]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86496]
[1035606]
[USN-2953-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
[SUSE-SU-2016:1279]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0534]
[RHSA-2016:1480]
[RHSA-2016:1481]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
[RHSA-2016:1132]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to DML.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to FTS.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0656.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to InnoDB.
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86424]
[1035606]
[USN-2953-1]
[USN-2954-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability than CVE-2016-0654.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
[USN-2954-1]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Optimizer.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Optimizer.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
[USN-2954-1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.
[openSUSE-SU-2016:1332]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86511]
[1035606]
[USN-2953-1]
Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Partition.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
[USN-2954-1]
Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption.
[openSUSE-SU-2016:1332]
[RHSA-2016:0705]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86513]
[1035606]
[USN-2953-1]
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges.
[SUSE-SU-2016:1279]
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[RHSA-2016:1480]
[RHSA-2016:1481]
[RHSA-2016:1602]
[DSA-3557]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[86509]
[1035606]
[USN-2953-1]
[USN-2954-1]
[http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/]
Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Locking.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035606]
[USN-2954-1]
Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.
[openSUSE-SU-2016:1332]
[SUSE-SU-2016:1619]
[SUSE-SU-2016:1620]
[openSUSE-SU-2016:1664]
[openSUSE-SU-2016:1686]
[RHSA-2016:0705]
[DSA-3595]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86467]
[1035606]
[USN-2953-1]
[RHSA-2016:1132]
[https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/]
[https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/]
Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect integrity and availability via vectors related to Fwflash.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035629]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL Module.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035617]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to Pre-Login.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035604]
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to UIF Open UI.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035598]
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality and integrity via vectors related to Email.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035598]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0700.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86450]
[1035615]
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to the kernel.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035629]
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote attackers to affect availability via unknown vectors.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035590]
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.18 allows local users to affect confidentiality, integrity, and availability via vectors related to Core.
[openSUSE-SU-2016:1451]
[openSUSE-SU-2016:1462]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035607]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect integrity and availability via vectors related to PIA Grids.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Services Procurement.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unspecified vectors.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035590]
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0689, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Search Framework.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the Oracle Retail MICROS ARS POS component in Oracle Retail Applications 1.5 allows remote authenticated users to affect confidentiality via vectors related to POS.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035600]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to File Processing.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.
[openSUSE-SU-2016:1222]
[openSUSE-SU-2016:1230]
[openSUSE-SU-2016:1235]
[SUSE-SU-2016:1248]
[SUSE-SU-2016:1250]
[openSUSE-SU-2016:1262]
[openSUSE-SU-2016:1265]
[SUSE-SU-2016:1299]
[SUSE-SU-2016:1300]
[SUSE-SU-2016:1303]
[SUSE-SU-2016:1378]
[SUSE-SU-2016:1379]
[SUSE-SU-2016:1388]
[SUSE-SU-2016:1458]
[SUSE-SU-2016:1475]
[RHSA-2016:0650]
[RHSA-2016:0651]
[RHSA-2016:0675]
[RHSA-2016:0676]
[RHSA-2016:0677]
[RHSA-2016:0678]
[RHSA-2016:0679]
[RHSA-2016:0701]
[RHSA-2016:0702]
[RHSA-2016:0708]
[RHSA-2016:0716]
[RHSA-2016:0723]
[RHSA-2016:1039]
[DSA-3558]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[86473]
[1035596]
[USN-2963-1]
[USN-2964-1]
[USN-2972-1]
[RHSA-2016:1430]
[RHSA-2017:1216]
[GLSA-201606-18]
[https://security.netapp.com/advisory/ntap-20160420-0001/]
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.
[openSUSE-SU-2016:1222]
[openSUSE-SU-2016:1230]
[openSUSE-SU-2016:1235]
[SUSE-SU-2016:1248]
[SUSE-SU-2016:1250]
[openSUSE-SU-2016:1262]
[openSUSE-SU-2016:1265]
[SUSE-SU-2016:1299]
[SUSE-SU-2016:1300]
[SUSE-SU-2016:1303]
[SUSE-SU-2016:1378]
[SUSE-SU-2016:1379]
[SUSE-SU-2016:1388]
[SUSE-SU-2016:1458]
[SUSE-SU-2016:1475]
[RHSA-2016:0650]
[RHSA-2016:0651]
[RHSA-2016:0675]
[RHSA-2016:0676]
[RHSA-2016:0677]
[RHSA-2016:0678]
[RHSA-2016:0679]
[RHSA-2016:0701]
[RHSA-2016:0702]
[RHSA-2016:0708]
[RHSA-2016:0716]
[RHSA-2016:0723]
[RHSA-2016:1039]
[DSA-3558]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[86459]
[1035596]
[USN-2963-1]
[USN-2964-1]
[USN-2972-1]
[RHSA-2016:1430]
[RHSA-2017:1216]
[GLSA-201606-18]
[https://security.netapp.com/advisory/ntap-20160420-0001/]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86469]
[1035615]
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0691.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035590]
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0690.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035590]
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0694, and CVE-2016-3418.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the PAM LDAP module.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035629]
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0692, and CVE-2016-3418.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.
[openSUSE-SU-2016:1222]
[openSUSE-SU-2016:1230]
[openSUSE-SU-2016:1235]
[SUSE-SU-2016:1248]
[SUSE-SU-2016:1250]
[openSUSE-SU-2016:1262]
[openSUSE-SU-2016:1265]
[RHSA-2016:0650]
[RHSA-2016:0651]
[RHSA-2016:0675]
[RHSA-2016:0676]
[RHSA-2016:0677]
[RHSA-2016:0678]
[RHSA-2016:0679]
[RHSA-2016:0723]
[DSA-3558]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[86438]
[1035596]
[USN-2963-1]
[USN-2964-1]
[USN-2972-1]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10159]
[GLSA-201606-18]
[https://security.netapp.com/advisory/ntap-20160420-0001/]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors related to Console.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86443]
[1035615]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows local users to affect confidentiality and integrity via unknown vectors.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035603]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Rich Text Editor, a different vulnerability than CVE-2016-3423.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035610]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to the Login sub-component.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[1035604]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0675.
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[86453]
[1035615]
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
[http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[FEDORA-2016-527018d2ff]
[openSUSE-SU-2016:0637]
[http://www.openssl.org/news/secadv/20160128.txt]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[82233]
[91787]
[1034849]
[USN-2883-1]
[https://git.openssl.org/?p=openssl.git;a=commit;h=878e2c5b13010329c203f309ed0c8f2113f85648]
[https://git.openssl.org/?p=openssl.git;a=commit;h=c5b831f21d0d29d1e517d139d9d101763f60c9a2]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893]
[GLSA-201601-05]
[VU#257823]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.
[http://cachebleed.info]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[FEDORA-2016-2802690366]
[FEDORA-2016-e6807b3394]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0627]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[SUSE-SU-2016:0641]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[openSUSE-SU-2016:1239]
[openSUSE-SU-2016:1241]
[openSUSE-SU-2016:1242]
[SUSE-SU-2016:1267]
[openSUSE-SU-2016:1273]
[SUSE-SU-2016:1290]
[SUSE-SU-2016:1360]
[openSUSE-SU-2016:1566]
[HPSBGN03563]
[http://openssl.org/news/secadv/20160301.txt]
[RHSA-2016:2957]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[DSA-3500]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[1035133]
[USN-2914-1]
[https://git.openssl.org/?p=openssl.git;a=commit;h=708dc2f1291e104fe4eef810bb8ffc1fae5b19c1]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[SUSE-SU-2016:0641]
[SUSE-SU-2016:0678]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[http://openssl.org/news/secadv/20160301.txt]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[83743]
[1035133]
[https://drownattack.com]
[https://git.openssl.org/?p=openssl.git;a=commit;h=ae50d8270026edf5b3c7f8aaa0c6677462b33d97]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[SUSE-SU-2016:0641]
[SUSE-SU-2016:0678]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[http://openssl.org/news/secadv/20160301.txt]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[83764]
[1035133]
[https://drownattack.com]
[https://git.openssl.org/?p=openssl.git;a=commit;h=ae50d8270026edf5b3c7f8aaa0c6677462b33d97]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
<a href="http://cwe.mitre.org/data/definitions/415.html" rel="nofollow">CWE-415: Double Free</a>
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[FEDORA-2016-2802690366]
[FEDORA-2016-e6807b3394]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0627]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[SUSE-SU-2016:1057]
[openSUSE-SU-2016:1332]
[openSUSE-SU-2016:1566]
[HPSBGN03563]
[HPSBGN03569]
[HPSBMU03575]
[http://openssl.org/news/secadv/20160301.txt]
[RHSA-2016:2957]
[http://source.android.com/security/bulletin/2016-05-01.html]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[DSA-3500]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[83754]
[91787]
[1035133]
[USN-2914-1]
[RHSA-2018:2568]
[RHSA-2018:2575]
[RHSA-2018:2713]
[https://git.openssl.org/?p=openssl.git;a=commit;h=6c88c71b4e4825c7bc0489306d062d017634eb88]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
[SUSE-SU-2016:0769]
[SUSE-SU-2016:0822]
[SUSE-SU-2016:0839]
[openSUSE-SU-2016:0865]
[HPSBUX03561]
[RHSA-2016:1089]
[RHSA-2016:2045]
[RHSA-2016:2599]
[RHSA-2016:2807]
[RHSA-2016:2808]
[20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass]
[http://svn.apache.org/viewvc?view=revision&revision=1722799]
[http://svn.apache.org/viewvc?view=revision&revision=1722800]
[http://svn.apache.org/viewvc?view=revision&revision=1722801]
[http://svn.apache.org/viewvc?view=revision&revision=1722802]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[http://tomcat.apache.org/security-9.html]
[DSA-3530]
[DSA-3552]
[DSA-3609]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html]
[83324]
[1035069]
[USN-3024-1]
[RHSA-2016:1087]
[RHSA-2016:1088]
[https://bto.bluecoat.com/security-advisory/sa118]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[GLSA-201705-09]
[https://security.netapp.com/advisory/ntap-20180531-0001/]
The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories.
[https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.1.2]
Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.
[https://www.cloudfoundry.org/blog/cve-2016-0708/]
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
[http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and]
[http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload]
[[portals-jetspeed-user] 20160303 [CVE-2016-0709] Apache Jetspeed information disclosure vulnerability]
[https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709]
[39643]
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
[http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and]
[http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html]
[http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload]
[[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability]
[https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710]
[39643]
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.
[[portals-jetspeed-user] 20160303 [CVE-2016-0711] Apache Jetspeed information disclosure vulnerability]
[https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0711]
Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.
[[portals-jetspeed-user] 20160303 [CVE-2016-0712] Apache Jetspeed information disclosure vulnerability]
[https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0712]
Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests.
[https://bosh.io/releases/github.com/cloudfoundry/cf-release?version=229]
[[cf-dev] 20160201 CVE-2016-0713 Gorouter XSS]
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
[SUSE-SU-2016:0769]
[SUSE-SU-2016:0822]
[SUSE-SU-2016:0839]
[openSUSE-SU-2016:0865]
[HPSBUX03561]
[RHSA-2016:1089]
[RHSA-2016:2045]
[RHSA-2016:2599]
[RHSA-2016:2807]
[RHSA-2016:2808]
[20160222 [SECURITY] CVE-2016-0714 Apache Tomcat Security Manager Bypass]
[http://svn.apache.org/viewvc?view=revision&revision=1725263]
[http://svn.apache.org/viewvc?view=revision&revision=1725914]
[http://svn.apache.org/viewvc?view=revision&revision=1726196]
[http://svn.apache.org/viewvc?view=revision&revision=1726203]
[http://svn.apache.org/viewvc?view=revision&revision=1726923]
[http://svn.apache.org/viewvc?view=revision&revision=1727034]
[http://svn.apache.org/viewvc?view=revision&revision=1727166]
[http://svn.apache.org/viewvc?view=revision&revision=1727182]
[http://tomcat.apache.org/security-6.html]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[http://tomcat.apache.org/security-9.html]
[DSA-3530]
[DSA-3552]
[DSA-3609]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html]
[83327]
[1035069]
[1037640]
[USN-3024-1]
[RHSA-2016:1087]
[RHSA-2016:1088]
[https://bto.bluecoat.com/security-advisory/sa118]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[GLSA-201705-09]
[https://security.netapp.com/advisory/ntap-20180531-0001/]
Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.
[https://pivotal.io/security/cve-2016-0715]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0729. Reason: This candidate is a reservation duplicate of CVE-2016-0729. Notes: All CVE users should reference CVE-2016-0729 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0729. Reason: This candidate is a reservation duplicate of CVE-2016-0729. Notes: All CVE users should reference CVE-2016-0729 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
[APPLE-SA-2016-07-18-1]
[openSUSE-SU-2016:1441]
[SUSE-SU-2016:1508]
[SUSE-SU-2016:1512]
[openSUSE-SU-2016:1523]
[openSUSE-SU-2016:1964]
[openSUSE-SU-2016:2026]
[http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html]
[RHSA-2016:2824]
[20170227 CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6]
[http://support.eset.com/ca6333/]
[DSA-3582]
[http://www.mozilla.org/security/announce/2016/mfsa2016-68.html]
[[oss-security] 20160517 CVE-2016-0718: Expat XML Parser Crashes on Malformed Input]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html]
[90729]
[1036348]
[1036415]
[1037705]
[USN-2983-1]
[USN-3044-1]
[RHSA-2018:2486]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1236923]
[https://bugzilla.redhat.com/show_bug.cgi?id=1296102]
[GLSA-201701-21]
[https://source.android.com/security/bulletin/2016-11-01.html]
[https://support.apple.com/HT206903]
[https://www.tenable.com/security/tns-2016-20]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0718. Reason: This candidate is a reservation duplicate of CVE-2016-0718. Notes: All CVE users should reference CVE-2016-0718 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
[FEDORA-2016-3b20c4ec9d]
[FEDORA-2016-cdd4228cc7]
[RHSA-2016:2596]
[97984]
[https://bugzilla.redhat.com/show_bug.cgi?id=1299614]
[https://github.com/ClusterLabs/pcs/commit/b9e7f061788c3b86a0c67d2d4158f067ec5eb625]
Session fixation vulnerability in pcsd in pcs before 0.9.157.
[FEDORA-2016-3b20c4ec9d]
[FEDORA-2016-cdd4228cc7]
[RHSA-2016:2596]
[97977]
[https://bugzilla.redhat.com/show_bug.cgi?id=1299615]
[https://github.com/ClusterLabs/pcs/commit/acdbbe8307e6f4a36b2c7754765e732e43fe8d17]
[https://github.com/ClusterLabs/pcs/commit/bc6ad9086857559db57f4e3e6de66762291c0774]
[https://github.com/ClusterLabs/pcs/commit/e9b28833d54a47ec441f6dbad0db96e1fc662a5b]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c17c861a357e9458001f021a7afa7aab9937439]
[FEDORA-2016-2f25d12c51]
[FEDORA-2016-5d43766e33]
[SUSE-SU-2016:0911]
[openSUSE-SU-2016:1008]
[SUSE-SU-2016:1102]
[SUSE-SU-2016:1764]
[SUSE-SU-2016:2074]
[http://source.android.com/security/bulletin/2016-07-01.html]
[DSA-3448]
[DSA-3503]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html]
[82950]
[1035695]
[USN-2929-1]
[USN-2929-2]
[USN-2930-1]
[USN-2930-2]
[USN-2930-3]
[USN-2932-1]
[USN-2948-1]
[USN-2948-2]
[USN-2967-1]
[USN-2967-2]
[https://bugzilla.redhat.com/show_bug.cgi?id=1296253]
[https://github.com/torvalds/linux/commit/5c17c861a357e9458001f021a7afa7aab9937439]
[https://security-tracker.debian.org/tracker/CVE-2016-0723]
[https://support.f5.com/csp/article/K43650115]
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52072]
[FEDORA-2016-fb2597f4eb]
[FEDORA-2016-1c10ab3c35]
[[oss-security] 20160118 [vs] moodle security release]
[1034694]
[https://moodle.org/mod/forum/discuss.php?d=326205]
Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52552]
[FEDORA-2016-fb2597f4eb]
[FEDORA-2016-1c10ab3c35]
[[oss-security] 20160118 [vs] moodle security release]
[1034694]
[https://moodle.org/mod/forum/discuss.php?d=326206]
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
[https://bugzilla.redhat.com/show_bug.cgi?id=1295446]
The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.
[http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html]
[81552]
[1034808]
[USN-3096-1]
[https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050]
[https://bugzilla.redhat.com/show_bug.cgi?id=1382369]
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
<a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a> <br />
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2]
[FEDORA-2016-5d43766e33]
[FEDORA-2016-b59fd603be]
[SUSE-SU-2016:0205]
[SUSE-SU-2016:0341]
[SUSE-SU-2016:0745]
[SUSE-SU-2016:0746]
[SUSE-SU-2016:0747]
[SUSE-SU-2016:0750]
[SUSE-SU-2016:0751]
[SUSE-SU-2016:0752]
[SUSE-SU-2016:0753]
[SUSE-SU-2016:0755]
[SUSE-SU-2016:0756]
[SUSE-SU-2016:0757]
[http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/]
[RHSA-2016:0064]
[RHSA-2016:0065]
[RHSA-2016:0068]
[http://source.android.com/security/bulletin/2016-03-01.html]
[DSA-3448]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1]
[[oss-security] 20160119 Linux kernel: use after free in keyring facility.]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[81054]
[1034701]
[USN-2870-1]
[USN-2870-2]
[USN-2871-1]
[USN-2871-2]
[USN-2872-1]
[USN-2872-2]
[USN-2872-3]
[USN-2873-1]
[https://bto.bluecoat.com/security-advisory/sa112]
[https://bugzilla.redhat.com/show_bug.cgi?id=1297475]
[https://github.com/torvalds/linux/commit/23567fd052a9abb6d67fe8e7a9ccdd9800a540f2]
[HPSBHF03436]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380]
[https://security.netapp.com/advisory/ntap-20160211-0001/]
[39277]
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
[FEDORA-2016-9ff972ca42]
[FEDORA-2016-ae9ac16cf3]
[FEDORA-2016-880b91c090]
[openSUSE-SU-2016:0966]
[openSUSE-SU-2016:1121]
[openSUSE-SU-2016:1808]
[http://packetstormsecurity.com/files/135949/Apache-Xerces-C-XML-Parser-Buffer-Overflow.html]
[http://svn.apache.org/viewvc?view=revision&revision=1727978]
[DSA-3493]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[20160225 CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input]
[83423]
[1035113]
[http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt]
[https://issues.apache.org/jira/browse/XERCESC-2061]
[GLSA-201612-46]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration.
[https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.2.1]
[https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.0/bk_releasenotes_ambari_2.2.1.0/content/ambari_relnotes-2.2.1.0-cves.html]
[https://issues.apache.org/jira/browse/AMBARI-14780]
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
[https://pivotal.io/security/cve-2016-0732]
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
[82871]
[https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger]
[https://issues.apache.org/jira/browse/RANGER-835]
[[ranger-dev] 20160205 CVE update (CVE-2015-5167 & CVE-2016-0733) - Fixed in Ranger 0.5.1]
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
[http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt]
[[oss-security] 20160310 [ANNOUNCE] CVE-2016-0734: ActiveMQ Web Console - Clickjacking]
[84321]
[1035327]
[RHSA-2016:1424]
[[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/]
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
[[ranger-dev] 20160328 CVE update (CVE-2016-0735) - Fixed in Ranger 0.5.2]
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
[RHSA-2017:1415]
[DSA-3796]
[95078]
[1037508]
[RHSA-2017:0906]
[RHSA-2017:1161]
[RHSA-2017:1413]
[RHSA-2017:1414]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us]
[https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-0736]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[GLSA-201701-36]
[https://security.netapp.com/advisory/ntap-20180423-0001/]
[https://support.apple.com/HT208221]
[40961]
[https://www.tenable.com/security/tns-2017-04]
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
[RHSA-2016:0128]
[RHSA-2016:0155]
[RHSA-2016:0329]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[81432]
[https://bugs.launchpad.net/swift/+bug/1466549]
[https://launchpad.net/swift/+milestone/2.4.0]
[https://review.openstack.org/#/c/217750/]
[https://security.openstack.org/ossa/OSSA-2016-004.html]
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
[FEDORA-2016-2256c80a94]
[RHSA-2016:0128]
[RHSA-2016:0155]
[RHSA-2016:0329]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[81432]
[https://bugs.launchpad.net/cloud-archive/+bug/1493303]
[https://github.com/openstack/swift/blob/master/CHANGELOG]
[https://security.openstack.org/ossa/OSSA-2016-004.html]
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
[FEDORA-2016-d9f950c779]
[FEDORA-2016-dc9e8da03c]
[openSUSE-SU-2016:0880]
[RHSA-2016:0566]
[DSA-3488]
[USN-2912-1]
[https://puppet.com/security/cve/CVE-2016-0739]
[GLSA-201606-12]
[https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/]
[https://www.libssh.org/security/advisories/CVE-2016-0739.txt]
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
[DSA-3499]
[https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst]
[https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e]
[GLSA-201612-52]
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
[http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-4-7.html]
[RHSA-2016:0204]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[82343]
[https://fedorahosted.org/389/changeset/cd45d032421b0ecf76d8cbb9b1c3aeef7680d9a2/]
[https://fedorahosted.org/389/ticket/48412]
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
<a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
[openSUSE-SU-2016:0371]
[[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)]
[DSA-3473]
[1034869]
[USN-2892-1]
[RHSA-2016:1425]
[https://bto.bluecoat.com/security-advisory/sa115]
[https://bugzilla.redhat.com/show_bug.cgi?id=1302587]
[GLSA-201606-06]
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
<a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a>
[openSUSE-SU-2016:0371]
[[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)]
[DSA-3473]
[1034869]
[USN-2892-1]
[RHSA-2016:1425]
[https://bto.bluecoat.com/security-advisory/sa115]
[https://bugzilla.redhat.com/show_bug.cgi?id=1302588]
[GLSA-201606-06]
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
[openSUSE-SU-2016:0371]
[[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)]
[DSA-3473]
[1034869]
[USN-2892-1]
[RHSA-2016:1425]
[https://bto.bluecoat.com/security-advisory/sa115]
[https://bugzilla.redhat.com/show_bug.cgi?id=1302589]
[GLSA-201606-06]
The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.
[openSUSE-SU-2016:1725]
[openSUSE-SU-2016:1726]
[DSA-3596]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[USN-3014-1]
[RHSA-2016:1204]
[RHSA-2016:1205]
[GLSA-201606-05]
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
[101910]
[RHSA-2017:3244]
[RHSA-2018:0501]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750]
[https://github.com/infinispan/infinispan/pull/5116]
[https://issues.jboss.org/browse/ISPN-7781]
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
[FEDORA-2016-94e71ee673]
[FEDORA-2016-f486068393]
[SUSE-SU-2016:1146]
[openSUSE-SU-2016:0363]
[openSUSE-SU-2016:0372]
[RHSA-2016:0296]
[DSA-3464]
[[oss-security] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack]
[81800]
[1034816]
[[ruby-security-ann] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack]
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
[FEDORA-2016-fa0dec2360]
[FEDORA-2016-97002ad37b]
[SUSE-SU-2016:1146]
[openSUSE-SU-2016:0363]
[openSUSE-SU-2016:0372]
[RHSA-2016:0296]
[DSA-3464]
[[oss-security] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View]
[81801]
[1034816]
[[ruby-security-ann] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View]
[40561]
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
[FEDORA-2016-73fe05d878]
[FEDORA-2016-94e71ee673]
[FEDORA-2016-cb30088b06]
[FEDORA-2016-cc465a34df]
[FEDORA-2016-eb4d6e8aab]
[SUSE-SU-2016:1146]
[openSUSE-SU-2016:0372]
[RHSA-2016:0296]
[DSA-3464]
[[oss-security] 20160125 [CVE-2016-0753] Possible Input Validation Circumvention in Active Model]
[82247]
[1034816]
[[ruby-security-ann] 20160125 [CVE-2016-0753] Possible Input Validation Circumvention in Active Model]
cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.
[http://curl.haxx.se/docs/adv_20160127B.html]
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
[http://curl.haxx.se/docs/adv_20160127A.html]
[APPLE-SA-2016-09-20]
[FEDORA-2016-3fa315a5dd]
[FEDORA-2016-55137a3adb]
[FEDORA-2016-5a141de5d9]
[FEDORA-2016-57bebab3b6]
[openSUSE-SU-2016:0360]
[openSUSE-SU-2016:0373]
[openSUSE-SU-2016:0376]
[http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html]
[DSA-3455]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[82307]
[1034882]
[SSA:2016-039-01]
[USN-2882-1]
[GLSA-201701-47]
[https://support.apple.com/HT207170]
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.
[http://blog.prosody.im/prosody-0-9-10-released/]
[FEDORA-2016-e2c5111eda]
[FEDORA-2016-5a5c85c5a8]
[DSA-3463]
[[oss-security] 20160127 CVE-2016-0756: Prosody XMPP server: insecure dialback key generation/validation algorithm]
[82241]
[https://prosody.im/issues/issue/596]
[https://prosody.im/security/advisory_20160127/]
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
[RHSA-2016:0309]
[82696]
[https://security.openstack.org/ossa/OSSA-2016-006.html]
Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.
<a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a>
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa]
[openSUSE-SU-2016:1641]
[SUSE-SU-2016:1672]
[SUSE-SU-2016:1690]
[SUSE-SU-2016:1937]
[SUSE-SU-2016:1961]
[SUSE-SU-2016:1985]
[SUSE-SU-2016:1994]
[SUSE-SU-2016:1995]
[SUSE-SU-2016:2000]
[SUSE-SU-2016:2001]
[SUSE-SU-2016:2002]
[SUSE-SU-2016:2003]
[SUSE-SU-2016:2005]
[SUSE-SU-2016:2006]
[SUSE-SU-2016:2007]
[SUSE-SU-2016:2009]
[SUSE-SU-2016:2010]
[SUSE-SU-2016:2011]
[SUSE-SU-2016:2014]
[SUSE-SU-2016:2105]
[openSUSE-SU-2016:2184]
[RHSA-2016:1033]
[RHSA-2016:1051]
[RHSA-2016:1055]
[http://source.android.com/security/bulletin/2016-10-01.html]
[[oss-security] 20160513 CVE-2016-0758 - Linux kernel - Flaw in ASN.1 DER decoder for x509 certificate DER files.]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[90626]
[USN-2979-4]
[https://bugzilla.redhat.com/show_bug.cgi?id=1300257]
[https://github.com/torvalds/linux/commit/23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa]
[HPSBHF3548]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-4003. Reason: This candidate is a reservation duplicate of CVE-2016-4003. Notes: All CVE users should reference CVE-2016-4003 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.
[[sentry-dev] 20160804 CVE-2016-0760: Hive builtin functions "reflect", "reflect2", and "java_method" are not blocked in Apache Sentry]
[92328]
Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container files during Docker image preparation that could be used to delete, corrupt or overwrite host files and directories, including other container filesystems on the host.
[https://pivotal.io/security/cve-2016-0761]
The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
[RHSA-2017:0457]
[DSA-3720]
[93939]
[1037144]
[RHSA-2017:0455]
[RHSA-2017:0456]
[RHSA-2017:2247]
[[announce] 20161027 [SECURITY] CVE-2016-0762 Apache Tomcat Realm Timing Attack]
[[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[https://security.netapp.com/advisory/ntap-20180605-0001/]
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
[FEDORA-2016-e6651efbaf]
[SUSE-SU-2016:0769]
[SUSE-SU-2016:0822]
[openSUSE-SU-2016:0865]
[RHSA-2016:1089]
[RHSA-2016:2599]
[RHSA-2016:2807]
[RHSA-2016:2808]
[20160222 [SECURITY] CVE-2016-0763 Apache Tomcat Security Manager Bypass]
[http://svn.apache.org/viewvc?view=revision&revision=1725926]
[http://svn.apache.org/viewvc?view=revision&revision=1725929]
[http://svn.apache.org/viewvc?view=revision&revision=1725931]
[http://tomcat.apache.org/security-7.html]
[http://tomcat.apache.org/security-8.html]
[http://tomcat.apache.org/security-9.html]
[DSA-3530]
[DSA-3552]
[DSA-3609]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[83326]
[1035069]
[USN-3024-1]
[RHSA-2016:1087]
[RHSA-2016:1088]
[https://bto.bluecoat.com/security-advisory/sa118]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755]
[[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[GLSA-201705-09]
[https://security.netapp.com/advisory/ntap-20180531-0001/]
Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.
[RHSA-2016:2581]
[https://bugzilla.redhat.com/show_bug.cgi?id=1324025]
Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.
[[oss-security] 20160202 Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14]
[82347]
[http://www.vapid.dhs.org/advisory.php?v=160]
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.
[openSUSE-SU-2016:0531]
[SUSE-SU-2016:0539]
[SUSE-SU-2016:0555]
[openSUSE-SU-2016:0578]
[SUSE-SU-2016:0677]
[DSA-3475]
[DSA-3476]
[http://www.postgresql.org/about/news/1644/]
[http://www.postgresql.org/docs/current/static/release-9-1-20.html]
[http://www.postgresql.org/docs/current/static/release-9-2-15.html]
[http://www.postgresql.org/docs/current/static/release-9-3-11.html]
[http://www.postgresql.org/docs/current/static/release-9-4-6.html]
[http://www.postgresql.org/docs/current/static/release-9-5-1.html]
[83184]
[1035005]
[USN-2894-1]
[GLSA-201701-33]
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.
[https://tada.github.io/pljava/releasenotes.html]
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
[https://tada.github.io/pljava/releasenotes.html]
Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
[[oss-security] 20160202 Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14]
[82347]
[http://www.vapid.dhs.org/advisory.php?v=160]
Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.
[[oss-security] 20160201 Wordpress plugin Reflected XSS in connections v8.5.8]
[82355]
[http://www.vapidlabs.com/advisory.php?v=161]
[https://wordpress.org/plugins/connections/changelog/]
The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.
[openSUSE-SU-2016:0813]
[DSA-3514]
[84273]
[1035219]
[USN-2922-1]
[https://bugzilla.samba.org/show_bug.cgi?id=11128]
[https://bugzilla.samba.org/show_bug.cgi?id=11686]
[https://www.samba.org/samba/security/CVE-2016-0771.html]
The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
[RHSA-2016:1626]
[RHSA-2016:1627]
[RHSA-2016:1628]
[RHSA-2016:1629]
[RHSA-2016:1630]
[[oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack]
[91225]
[http://www.splunk.com/view/SP-CAAAPSV]
[http://www.splunk.com/view/SP-CAAAPUE]
[https://bugzilla.redhat.com/show_bug.cgi?id=1303647]
[https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5]
[https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2]
[https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS]
[https://hg.python.org/cpython/rev/b3ce713fb9be]
[https://hg.python.org/cpython/rev/d590114c2394]
[[debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update]
[GLSA-201701-18]
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.
[FEDORA-2016-e0a6c9ebc4]
[FEDORA-2016-b0c2412ab2]
[openSUSE-SU-2016:0531]
[SUSE-SU-2016:0539]
[SUSE-SU-2016:0555]
[openSUSE-SU-2016:0578]
[SUSE-SU-2016:0677]
[RHSA-2016:1060]
[DSA-3475]
[DSA-3476]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[http://www.postgresql.org/about/news/1644/]
[http://www.postgresql.org/docs/current/static/release-9-1-20.html]
[http://www.postgresql.org/docs/current/static/release-9-2-15.html]
[http://www.postgresql.org/docs/current/static/release-9-3-11.html]
[http://www.postgresql.org/docs/current/static/release-9-4-6.html]
[http://www.postgresql.org/docs/current/static/release-9-5-1.html]
[83184]
[1035005]
[USN-2894-1]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10152]
[https://puppet.com/security/cve/CVE-2016-0773]
[GLSA-201701-33]
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
[SUSE-SU-2016:1031]
[SUSE-SU-2016:1032]
[SUSE-SU-2016:1033]
[SUSE-SU-2016:1034]
[SUSE-SU-2016:1035]
[SUSE-SU-2016:1037]
[SUSE-SU-2016:1038]
[SUSE-SU-2016:1039]
[SUSE-SU-2016:1040]
[SUSE-SU-2016:1041]
[SUSE-SU-2016:1045]
[SUSE-SU-2016:1046]
[RHSA-2016:0494]
[RHSA-2016:0617]
[http://source.android.com/security/bulletin/2016-05-01.html]
[DSA-3503]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[84126]
[USN-2967-1]
[USN-2967-2]
[USN-2968-1]
[USN-2968-2]
[https://bugzilla.redhat.com/show_bug.cgi?id=1303961]
[https://security-tracker.debian.org/tracker/CVE-2016-0774]
Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
[DSA-3499]
[https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst]
[https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b]
[GLSA-201612-52]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734]
[APPLE-SA-2016-03-21-5]
[FEDORA-2016-2e89eba0c1]
[FEDORA-2016-67c6ef0d4f]
[FEDORA-2016-c330264861]
[FEDORA-2016-4556904561]
[SUSE-SU-2016:0117]
[SUSE-SU-2016:0118]
[SUSE-SU-2016:0119]
[SUSE-SU-2016:0120]
[openSUSE-SU-2016:0127]
[openSUSE-SU-2016:0128]
[http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html]
[20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[DSA-3446]
[http://www.openssh.com/txt/release-7.1p2]
[[oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[80695]
[1034671]
[USN-2869-1]
[https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/]
[https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/]
[https://bto.bluecoat.com/security-advisory/sa109]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[FreeBSD-SA-16:07]
[GLSA-201601-01]
[https://support.apple.com/HT206167]
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734]
[APPLE-SA-2016-03-21-5]
[FEDORA-2016-2e89eba0c1]
[FEDORA-2016-4556904561]
[SUSE-SU-2016:0117]
[SUSE-SU-2016:0118]
[SUSE-SU-2016:0119]
[SUSE-SU-2016:0120]
[openSUSE-SU-2016:0127]
[openSUSE-SU-2016:0128]
[http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html]
[20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[DSA-3446]
[http://www.openssh.com/txt/release-7.1p2]
[[oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778]
[80698]
[1034671]
[USN-2869-1]
[https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/]
[https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/]
[https://bto.bluecoat.com/security-advisory/sa109]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[GLSA-201601-01]
[https://support.apple.com/HT206167]
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
[http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html]
[http://tomee.apache.org/security/tomee.html]
[[tomee-dev] 20160404 Document resolved vulnerability CVE-2015-8581]
[20160315 [ANNOUNCE][CVE-2016-0779] Apache TomEE 1.7.4 and 7.0.0-M3 releases]
[79204]
[http://www.zerodayinitiative.com/advisories/ZDI-15-638]
It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions prior to 1.6.18 do not properly enforce disk quotas in certain cases. An attacker could use an improper disk quota value to bypass enforcement and consume all the disk on DEAs/CELLs causing a potential denial of service for other applications.
[https://pivotal.io/security/cve-2016-0780]
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.
[https://pivotal.io/security/cve-2016-0781]
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
[http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt]
[http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html]
[20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting]
[1035328]
[RHSA-2016:1424]
[https://bugzilla.redhat.com/show_bug.cgi?id=1317516]
[[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/]
The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.
[http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code]
[http://openmeetings.apache.org/security.html]
[http://packetstormsecurity.com/files/136432/Apache-OpenMeetings-3.1.0-MD5-Hashing.html]
[20160325 [CVE-2016-0783] Predictable password reset token]
[https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG]
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
[http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code]
[http://openmeetings.apache.org/security.html]
[http://packetstormsecurity.com/files/136484/Apache-OpenMeetings-3.1.0-Path-Traversal.html]
[[oss-security] 20160325 [CVE-2016-0784] ZIP file path traversal]
[20160330 [CVE-2016-0784] Apache OpenMeetings ZIP file path traversal]
[https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG]
[39642]
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
[http://struts.apache.org/docs/s2-029.html]
[85066]
[1035271]
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
[FEDORA-2016-215a2219b1]
[FEDORA-2016-7942ee2cc5]
[openSUSE-SU-2016:0639]
[DSA-3487]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[82514]
[https://bto.bluecoat.com/security-advisory/sa120]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10156]
[https://puppet.com/security/cve/CVE-2016-0787]
[GLSA-201606-12]
[https://www.libssh2.org/adv_20160223.html]
[https://www.libssh2.org/CVE-2016-0787.patch]
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
[RHSA-2016:1773]
[RHSA-2016:0711]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24]
CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
[RHSA-2016:1773]
[RHSA-2016:0711]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24]
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
[RHSA-2016:1773]
[RHSA-2016:0711]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24]
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
[RHSA-2016:1773]
[RHSA-2016:0711]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24]
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
[RHSA-2016:1773]
[RHSA-2016:0711]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24]
[https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream]
[42394]
[43375]
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
[http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html]
[https://bugzilla.redhat.com/show_bug.cgi?id=1305937]
[https://security.netapp.com/advisory/ntap-20180215-0001/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us]
[39573]
The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.
[FEDORA-2016-962c0d156d]
[openSUSE-SU-2016:1415]
[openSUSE-SU-2016:1805]
[RHSA-2016:2579]
[DSA-3482]
[1035022]
[USN-2899-1]
[https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794/]
[20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro 'ReadRootData' Buffer Overflow Vulnerability]
[20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro TabRack Buffer Overflow Vulnerability]
[20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro Bullet Buffer Overflow Vulnerability]
LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.
[FEDORA-2016-962c0d156d]
[openSUSE-SU-2016:1415]
[openSUSE-SU-2016:1805]
[RHSA-2016:2579]
[DSA-3482]
[1035022]
[USN-2899-1]
[https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795/]
[20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro 'TocSuperLayout' Buffer Overflow Vulnerability]
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
<a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a>
<a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a>
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0627]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[openSUSE-SU-2016:0640]
[SUSE-SU-2016:0641]
[SUSE-SU-2016:0678]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[openSUSE-SU-2016:1239]
[openSUSE-SU-2016:1241]
[openSUSE-SU-2016:1566]
[HPSBGN03563]
[http://openssl.org/news/secadv/20160301.txt]
[RHSA-2016:2957]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[DSA-3500]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[83763]
[91787]
[1035133]
[USN-2914-1]
[https://git.openssl.org/?p=openssl.git;a=commit;h=c175308407858afff3fc8c2e5e085d94d12edc7d]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10156]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt, related to apps/s_server.c and crypto/srp/srp_vfy.c.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[openSUSE-SU-2016:0627]
[openSUSE-SU-2016:0628]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[http://openssl.org/news/secadv/20160301.txt]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[DSA-3500]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[83705]
[91787]
[1035133]
[USN-2914-1]
[https://git.openssl.org/?p=openssl.git;a=commit;h=259b664f950c2ba66fbf4b0fe5281327904ead21]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[FEDORA-2016-2802690366]
[FEDORA-2016-e6807b3394]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[openSUSE-SU-2016:0640]
[SUSE-SU-2016:0641]
[SUSE-SU-2016:0678]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[openSUSE-SU-2016:1239]
[openSUSE-SU-2016:1241]
[HPSBGN03569]
[HPSBMU03575]
[http://openssl.org/news/secadv/20160301.txt]
[RHSA-2016:0722]
[RHSA-2016:0996]
[RHSA-2016:2073]
[RHSA-2016:2957]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[DSA-3500]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[83755]
[91787]
[1035133]
[USN-2914-1]
[https://git.openssl.org/?p=openssl.git;a=commit;h=578b956fe741bf8e84055547b1e83c28dd902c73]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://www.openssl.org/news/secadv/20160301.txt]
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10722]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759]
[SUSE-SU-2016:0617]
[SUSE-SU-2016:0620]
[SUSE-SU-2016:0621]
[SUSE-SU-2016:0624]
[openSUSE-SU-2016:0627]
[openSUSE-SU-2016:0628]
[SUSE-SU-2016:0631]
[openSUSE-SU-2016:0637]
[openSUSE-SU-2016:0638]
[openSUSE-SU-2016:0640]
[SUSE-SU-2016:0641]
[SUSE-SU-2016:0678]
[openSUSE-SU-2016:0720]
[SUSE-SU-2016:1057]
[openSUSE-SU-2016:1239]
[openSUSE-SU-2016:1241]
[HPSBGN03569]
[HPSBMU03575]
[HPSBMU03573]
[RHSA-2016:1519]
[http://support.citrix.com/article/CTX208403]
[20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016]
[http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-openssl-en]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[83733]
[91787]
[1035133]
[http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-623229.pdf]
[https://access.redhat.com/security/vulnerabilities/drown]
[https://drownattack.com]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us]
[https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073516]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05096953]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05143554]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176765]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05307589]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804]
[https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-103-03]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10154]
[FreeBSD-SA-16:12]
[GLSA-201603-15]
[https://security.netapp.com/advisory/ntap-20160301-0001/]
[VU#583776]
[https://www.openssl.org/news/secadv/20160301.txt]
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.
[APPLE-SA-2016-03-21-1]
[APPLE-SA-2016-03-21-2]
[APPLE-SA-2016-03-21-3]
[APPLE-SA-2016-03-21-5]
[http://source.android.com/security/bulletin/2016-02-01.html]
[http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt]
[1035353]
[[debian-lts-announce] 20181113 [SECURITY] [DLA 1573-1] firmware-nonfree security update]
[https://support.apple.com/HT206166]
[https://support.apple.com/HT206167]
[https://support.apple.com/HT206168]
[https://support.apple.com/HT206169]
[39801]
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25306181.
[APPLE-SA-2016-03-21-1]
[APPLE-SA-2016-03-21-2]
[APPLE-SA-2016-03-21-3]
[APPLE-SA-2016-03-21-5]
[http://source.android.com/security/bulletin/2016-02-01.html]
[http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt]
[1035353]
[https://support.apple.com/HT206166]
[https://support.apple.com/HT206167]
[https://support.apple.com/HT206168]
[https://support.apple.com/HT206169]
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fav/+/50270d98e26fa18b20ca88216c3526667b724ba7]
The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fav/+/224858e719d045c8554856b12c4ab73d2375cf33]
The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25773204.
[http://source.android.com/security/bulletin/2016-02-01.html]
The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25344453.
[http://source.android.com/security/bulletin/2016-02-01.html]
The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fsystem%2Fcore/+/d917514bd6b270df431ea4e781a865764d406120]
Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform/frameworks/minikin/+/ed4c8d79153baab7f26562afb8930652dfbf853b]
Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform/hardware/broadcom/wlan/+/2c5a4fac8bc8198f6a2635ede776f8de40a0c3e1]
media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25781119.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fav/+/19c47afbc402542720ddd280e1bbde3b2277b586]
Integer overflow in the BnCrypto::onTransact function in media/libmedia/ICrypto.cpp in libmediaplayerservice in Android 6.x before 2016-02-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an improper size calculation, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25800375.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fav/+/22f824feac43d5758f9a70b77f2aca840ba62c3b]
The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.0 before 2016-02-01 does not properly check for setup completion, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25229538.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/84669ca8de55d38073a0dcb01074233b0a417541]
packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-01 does not properly check for device provisioning, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25476219.
[http://source.android.com/security/bulletin/2016-02-01.html]
[https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/16a76dadcc23a13223e9c2216dad1fe5cad7d6e1]
The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84235]
[https://android.googlesource.com/platform%2Fframeworks%2Fav/+/5403587a74aee2fb57076528c3927851531c8afb]
mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to decoder/ih264d_parse_islice.c and decoder/ih264d_parse_pslice.c, aka internal bug 25928803.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84235]
[https://android.googlesource.com/platform/external/libavc/+/4a524d3a8ae9aa20c36430008e6bd429443f8f1d]
The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84245]
[https://android.googlesource.com/platform/external/conscrypt/+/4c9f9c2201116acf790fca25af43995d29980ee0]
[https://android.googlesource.com/platform/external/conscrypt/+/c4ab1b959280413fb11bf4fd7f6b4c2ba38bd779]
The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 25364034.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84250]
The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 26267358.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84257]
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8a5e5e02fc83aaf67053ab53b359af08c6c49aaf]
[http://source.android.com/security/bulletin/2016-03-01.html]
[DSA-3607]
[[oss-security] 20150502 Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam]
[84260]
[USN-2967-1]
[USN-2967-2]
[USN-2968-1]
[USN-2968-2]
[USN-2969-1]
[USN-2970-1]
[USN-2971-1]
[USN-2971-2]
[USN-2971-3]
[https://github.com/torvalds/linux/commit/8a5e5e02fc83aaf67053ab53b359af08c6c49aaf]
The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access, aka internal bug 25873324.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84263]
The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce]
[http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html]
[http://source.android.com/security/bulletin/2016-03-01.html]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3]
[84265]
[https://github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce]
libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84262]
[https://android.googlesource.com/platform/external/libmpeg2/+/ffab15eb80630dc799eb410855c93525b75233c3]
The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging kernel access, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 20860039.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84269]
libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dump method for a camera service dump, which allows attackers to gain privileges via a crafted application that directly dumps, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26265403.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84268]
[https://android.googlesource.com/platform/frameworks/av/+/899823966e78552bb6dfd7772403a4f91471d2b0]
[https://android.googlesource.com/platform/frameworks/av/+/c9ab2b0bb05a7e19fb057e79b36e232809d70122]
Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, related to EffectBundle.cpp and EffectReverb.cpp, aka internal bug 26347509.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84268]
[https://android.googlesource.com/platform/frameworks/av/+/9e29523b9537983b4c4b205ff868d0b3bca0383b]
The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84261]
[https://android.googlesource.com/platform/frameworks/native/+/dded8fdbb700d6cc498debc69a780915bc34d755]
The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering a QUEUE_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338109.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84261]
[https://android.googlesource.com/platform/frameworks/native/+/d06421fd37fbb7fd07002e6738fac3a223cb1a62]
btif_config.c in Bluetooth in Android 6.x before 2016-03-01 allows remote attackers to cause a denial of service (memory corruption and persistent daemon crash) by triggering a large number of configuration entries, and consequently exceeding the maximum size of a configuration file, aka internal bug 26071376.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84270]
[https://android.googlesource.com/platform/system/bt/+/d77f1999ecece56c1cbb333f4ddc26f0b5bac2c5]
The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25778215.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84266]
[https://android.googlesource.com/platform/frameworks/opt/telephony/+/79eecef63f3ea99688333c19e22813f54d4a31b1]
Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042.
[http://source.android.com/security/bulletin/2016-03-01.html]
[84264]
Android allows users to cause a denial of service.
[98009]
[http://www.securityfocus.com/bid/98009/info]
An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26220548.
[http://nvidia.custhelp.com/app/answers/detail/a_id/4561]
[http://source.android.com/security/bulletin/2016-04-02.html]
decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/libmpeg2/+/58a6822d7140137ce957c6d2fc20bae1374186c1]
[https://android.googlesource.com/platform/external/libmpeg2/+/ba604d336b40fd4bde1622f64d67135bdbd61301]
Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/libmpeg2/+/8b4ed5a23175b7ffa56eea4678db7287f825e985]
MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/frameworks/av/+/7a282fb64fef25349e9d341f102d9cea3bf75baf]
Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/sonivox/+/24d7c408c52143bce7b49de82f3913fd8d1219cf]
[https://android.googlesource.com/platform/external/sonivox/+/3ac044334c3ff6a61cb4238ff3ddaf17c7efcf49]
post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/hardware/qcom/audio/+/ebbb82365172337c6c250c6cac4e326970a9e351]
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26399350.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/libavc/+/c57fc3703ae2e0d41b1f6580c50015937f2d23c1]
media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/frameworks/av/+/3097f364237fb552871f7639d37a7afa4563e252]
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/libavc/+/943323f1d9d3dd5c2634deb26cbe72343ca6b3db]
The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197.
[http://source.android.com/security/bulletin/2016-04-02.html]
The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via a crafted application, aka internal bug 26324307.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/sepolicy/+/57531cacb40682be4b1189c721fd1e7f25bf3786]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/frameworks/native/+/f3199c228aced7858b75a8070b8358c155ae0149]
[39686]
The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/packages/services/Telecomm/+/2750faaa1ec819eed9acffea7bd3daf867fda444]
[https://android.googlesource.com/platform/packages/services/Telephony/+/a294ae5342410431a568126183efe86261668b5d]
Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26211054.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/bdc831357e7a116bc561d51bf2ddc85ff11c01a9]
Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/bootable/recovery/+/28a566f7731b4cb76d2a9ba16d997ac5aeb07dad]
The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752.
[http://source.android.com/security/bulletin/2016-04-02.html]
[https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/c677ee92595335233eb0e7b59809a1a94e7a678a]
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a>
[http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload]
[http://www.zerodayinitiative.com/advisories/ZDI-16-127]
[http://www.zerodayinitiative.com/advisories/ZDI-16-128]
[http://www.zerodayinitiative.com/advisories/ZDI-16-129]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
[39735]
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
[http://www.zerodayinitiative.com/advisories/ZDI-16-122]
[http://www.zerodayinitiative.com/advisories/ZDI-16-123]
[http://www.zerodayinitiative.com/advisories/ZDI-16-124]
[http://www.zerodayinitiative.com/advisories/ZDI-16-125]
[http://www.zerodayinitiative.com/advisories/ZDI-16-126]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
[http://www.zerodayinitiative.com/advisories/ZDI-16-100]
[http://www.zerodayinitiative.com/advisories/ZDI-16-101]
[http://www.zerodayinitiative.com/advisories/ZDI-16-102]
[http://www.zerodayinitiative.com/advisories/ZDI-16-103]
[http://www.zerodayinitiative.com/advisories/ZDI-16-106]
[http://www.zerodayinitiative.com/advisories/ZDI-16-108]
[http://www.zerodayinitiative.com/advisories/ZDI-16-109]
[http://www.zerodayinitiative.com/advisories/ZDI-16-110]
[http://www.zerodayinitiative.com/advisories/ZDI-16-111]
[http://www.zerodayinitiative.com/advisories/ZDI-16-112]
[http://www.zerodayinitiative.com/advisories/ZDI-16-113]
[http://www.zerodayinitiative.com/advisories/ZDI-16-114]
[http://www.zerodayinitiative.com/advisories/ZDI-16-115]
[http://www.zerodayinitiative.com/advisories/ZDI-16-116]
[http://www.zerodayinitiative.com/advisories/ZDI-16-117]
[http://www.zerodayinitiative.com/advisories/ZDI-16-118]
[http://www.zerodayinitiative.com/advisories/ZDI-16-120]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
[http://www.zerodayinitiative.com/advisories/ZDI-16-107]
[http://www.zerodayinitiative.com/advisories/ZDI-16-119]
[http://www.zerodayinitiative.com/advisories/ZDI-16-121]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
[http://www.zerodayinitiative.com/advisories/ZDI-16-105]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.
[http://www.zerodayinitiative.com/advisories/ZDI-16-104]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.
[http://www.zerodayinitiative.com/advisories/ZDI-16-058]
[http://www.zerodayinitiative.com/advisories/ZDI-16-074]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01]
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.
[http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf]
[http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html]
[20160203 GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Sensitive Info Vulnerabilities]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02]
[39408]
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors.
[http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf]
[http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html]
[20160203 GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Sensitive Info Vulnerabilities]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02]
[39408]
Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to hijack the authentication of arbitrary users.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01]
Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01]
Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01]
Cross-site scripting (XSS) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01]
CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-021-01]
Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.
[1034861]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-026-02]
Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document.
[http://www.promotic.eu/en/pmdoc/NewsPm803.htm#ver80311]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-026-01]
The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
[92979]
[https://ics-cert.us-cert.gov/advisories/ICSA-16-259-03]
Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-061-03]
A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07]
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01]
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01]
Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01]
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01]
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and obtain sensitive repository information by appending a query to a REST request.
[20160209 ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities]
[1034993]
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
<a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
[20160209 ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities]
[1034993]
Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.
[https://pivotal.io/security/pcf-ops-manager-weak-authentication-scheme]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_member API call.
[20160307 ESA-2016-012: EMC Documentum xCP - User Information Disclosure Vulnerability]
[84210]
[1035197]
EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.
[http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html]
[20160411 ESA-2016-013: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Lenstra's Attack Vulnerability]
[20160411 ESA-2016-013: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Lenstra?s Attack Vulnerability]
[1035515]
[1035516]
[1035517]
EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors.
[20160404 ESA-2016-034: EMC Documentum D2 Configuration Object Vulnerability]
[1035459]
An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.
[20160414 ESA-2016-036: EMC Unisphere for VMAX Virtual Appliance Arbitrary File Upload Vulnerability]
[1035580]
EMC PowerPath Virtual (Management) Appliance 2.0, EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulnerability that may potentially be exploited by malicious users to compromise the affected system.
[http://www.securityfocus.com/archive/1/540065/30/0/threaded]
[95832]
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.
[http://packetstormsecurity.com/files/136837/EMC-ViPR-SRM-Cross-Site-Request-Forgery.html]
[20160419 ESA-2016-039: EMC ViPR SRM Multiple Cross-Site Request Forgery Vulnerabilities]
[20160427 EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection]
[20160427 EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection]
[39738]
[https://www.securify.nl/advisory/SFY20141109/emc_m_r__watch4net__lacks_c%20ross_site_request_forgery_protection.html]
Cross-site scripting (XSS) vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html]
[20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities]
[1035714]
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages.
[http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html]
[20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities]
[1035714]
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter.
[http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html]
[20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities]
[1035714]
EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity.
[http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html]
[20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities]
[1035714]
Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.
[92161]
[https://pivotal.io/security/cve-2016-0896]
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.
[https://pivotal.io/security/cve-2016-0897]
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM.
[95146]
[https://pivotal.io/security/cve-2016-0898]
EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files.
[20160613 ESA-2016-047: RSA Archer GRC Platform Sensitive Information Disclosure Vulnerability]
[1036080]
Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0901.
[http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html]
[20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities]
[1035755]
Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0900.
[http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html]
[20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities]
[1035755]
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
<a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html]
[20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities]
[1035755]
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent.
[20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities]
[93026]
[1036844]
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.
[20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities]
[93026]
[1036844]
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.
[20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities]
[93032]
[1036844]
The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read or delete directories via a Linux backup-restore operation.
[20160706 ESA-2016-054: EMC Avamar Data Store and Avamar Virtual Edition Unauthorized Data Access Vulnerability]
[1036235]
EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a similar issue to CVE-2016-2115.
[20160526 ESA-2016-061: EMC Isilon OneFS SMB Signing Vulnerability]
EMC Isilon OneFS 7.1.x before 7.1.1.9 and 7.2.x before 7.2.1.2 allows local users to obtain root shell access by leveraging administrative privileges.
[20160602 ESA-2016-060: EMC Isilon OneFS Privilege Escalation Vulnerability]
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users.
[http://www.securityfocus.com/archive/1/539613]
[93788]
[1037066]
EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors.
[20160608 ESA-2016-064: EMC Data Domain Information Disclosure Vulnerability]
[1036074]
EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges.
[20160610 ESA-2016-062: EMC Data Domain Multiple Vulnerabilities]
[1036079]
EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.
[20160610 ESA-2016-062: EMC Data Domain Multiple Vulnerabilities]
[1036079]
The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.
[20161004 ESA-2016-063: EMC Replication Manager and Network Module for Microsoft Remote Code Execution Vulnerability]
[93348]
[1036940]
EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended access restrictions and execute arbitrary IAPI/IDQL commands via the IAPI/IDQL interface.
[20160622 ESA-2016-069: EMC Documentum WebTop and WebTop Clients Improper Authorization Vulnerability]
[1036153]
The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request, related to a "direct object reference vulnerability."
[20160806 ESA-2016-070: RSA Authentication Manager Prime SelfService Insecure Direct Object Reference Vulnerability]
[92394]
[1036557]
EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.
[20160608 ESA-2016-072: EMC NetWorker Remote Code Execution Vulnerability]
[1036075]
The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.
[20160919 ESA-2016-096: EMC Celerra, VNX1, VNX2 and VNXe SMB NTLM Authentication Weak Nonce Vulnerability]
[http://www.securityfocus.com/archive/1/539993/30/0/threaded]
[93023]
[1036843]
EMC RSA Identity Management and Governance before 6.8.1 P25 and 6.9.x before 6.9.1 P15 and RSA Via Lifecycle and Governance before 7.0.0 P04 allow remote authenticated users to obtain User Detail Popup information via a modified URL.
[20160923 ESA-2016-097: RSA Identity Governance and Lifecycle Information Disclosure Vulnerability]
[93108]
[1036896]
EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
[http://www.securityfocus.com/archive/1/540057/30/0/threaded]
[95820]
[1037726]
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
[20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities]
[1036844]
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program.
[20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities]
[93032]
[1036844]
EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.
[20160913 ESA-2016-104: EMC ViPR SRM Multiple Vulnerabilities]
[92945]
The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server behavior in which the first algorithm is used.
[20160915 ESA-2016-094: RSA BSAFE Micro Edition Suite Multiple Vulnerabilities]
[92994]
[1036835]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-2761. Reason: This candidate is subsumed by CVE-2004-2761. Notes: All CVE users should reference CVE-2004-2761 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[20160920 ESA-2016-093: RSA Adaptive Authentication (On-Premise) Cross-Site Scripting Vulnerability]
[93025]
[1036851]
Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework.
[91677]
[https://pivotal.io/security/cve-2016-0926]
Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[https://pivotal.io/security/cve-2016-0927]
Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
[91550]
[https://pivotal.io/security/cve-2016-0928]
The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials from a command line.
[91801]
[https://pivotal.io/security/cve-2016-0929]
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.
[93027]
[https://pivotal.io/security/cve-2016-0930]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FileAttachment annotation, a different vulnerability than CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-009]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0934, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-008]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
[20160112 Adobe Reader "U3D Bone Weight Modifier" Out-of-bounds Read Vulnerability]
Use-after-free vulnerability in AGM.dll in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2016-0932, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-016]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted ExtGState dictionary.
<a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a>
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-017]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG 2000 data, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-014]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Use-after-free vulnerability in the OCG object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0940, and CVE-2016-0941.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-011]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
The AcroForm plugin in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-013]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-015]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0941.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0940.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-010]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X mishandle the Global object, which allows attackers to bypass JavaScript API execution restrictions via unspecified vectors.
[1034646]
[http://zerodayinitiative.com/advisories/ZDI-16-012]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0945, and CVE-2016-0946.
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, and CVE-2016-0946.
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, and CVE-2016-0945.
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Untrusted search path vulnerability in Adobe Download Manager, as used in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allows local users to gain privileges via a crafted resource in an unspecified directory.
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[1034646]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Cross-site request forgery (CSRF) vulnerability in Adobe Connect before 9.5.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[1034978]
[https://helpx.adobe.com/security/products/connect/apsb16-07.html]
Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL.
[1034978]
[https://helpx.adobe.com/security/products/connect/apsb16-07.html]
Adobe Connect before 9.5.2 allows remote attackers to spoof the user interface via unspecified vectors.
[1034978]
[https://helpx.adobe.com/security/products/connect/apsb16-07.html]
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0952 and CVE-2016-0953.
[1034979]
[https://helpx.adobe.com/security/products/photoshop/apsb16-03.html]
[39429]
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0951 and CVE-2016-0953.
[1034979]
[https://helpx.adobe.com/security/products/photoshop/apsb16-03.html]
[39430]
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0951 and CVE-2016-0952.
[1034979]
[https://helpx.adobe.com/security/products/photoshop/apsb16-03.html]
[39431]
Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[84214]
[1035201]
[https://helpx.adobe.com/security/products/Digital-Editions/apsb16-06.html]
[39533]
Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog.
[http://www.csnc.ch/misc/files/advisories/CVE-2016-0955_AEM-XSS.txt]
[https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html]
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
[http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html]
[20160210 Apache Sling Framework v2.3.6 (Adobe AEM) [CVE-2016-0956] - Information Disclosure Vulnerability]
[20160210 Apache Sling Framework v2.3.6 - Information Disclosure Vulnerability]
[https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html]
[39435]
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.
[https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html]
Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object.
[https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html]
Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.
[RHSA-2015:2697]
[https://bugzilla.redhat.com/show_bug.cgi?id=1294580]
[https://helpx.adobe.com/security/products/flash-player/apsb16-01.html]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0993 and CVE-2016-1010.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84308]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39467]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39460]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39466]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39465]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via a URLLoader.load call, a different vulnerability than CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[http://zerodayinitiative.com/advisories/ZDI-16-161/]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39463]
Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code by leveraging improper reference handling, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[http://zerodayinitiative.com/advisories/ZDI-16-160/]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0980, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0981.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0980.
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0983, and CVE-2016-0984.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0984.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39462]
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
<a href="http://cwe.mitre.org/data/definitions/843.html">CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')</a>
[SUSE-SU-2016:0398]
[SUSE-SU-2016:0400]
[openSUSE-SU-2016:0412]
[openSUSE-SU-2016:0415]
[RHSA-2016:0166]
[1034970]
[https://helpx.adobe.com/security/products/flash-player/apsb16-04.html]
[GLSA-201603-07]
[39461]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1002, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84308]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[http://www.zerodayinitiative.com/advisories/ZDI-16-194/]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[http://www.zerodayinitiative.com/advisories/ZDI-16-193/]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39613]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39612]
[39631]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39611]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[RHSA-2016:1582]
[RHSA-2016:1583]
[84312]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39610]
Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection
[94496]
[https://www.tenable.com/security/research/tra-2016-15]
flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect
[https://github.com/puiterwijk/flask-oidc/blob/master/flask_oidc/__init__.py#L293]
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
[https://github.com/fedora-infra/mirrormanager2/commit/2e227f6023477cbdbefd577f15d0846aa40c8775.patch]
[https://github.com/fedora-infra/mirrormanager2/commit/eb9b542bc818071b9eee41c3583b7e6e172b3a53.patch]
Pagure 2.2.1 XSS in raw file endpoint
[https://pagure.io/pagure/c/070d63983fe5daef92005ea33d3b8c693c224c77.patch]
TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.
[20160701 Logic security flaw in TP-LINK - tplinklogin.net]
[https://pbs.twimg.com/media/CmnQ3F0WIAAs_X0.jpg]
[https://pbs.twimg.com/media/CmnQGI0WAAIbPHA.jpg]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10531. Reason: This candidate is a reservation duplicate of CVE-2016-10531. Notes: All CVE users should reference CVE-2016-10531 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3956. Reason: This candidate is a duplicate of CVE-2016-3956. Notes: All CVE users should reference CVE-2016-3956 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-2016-10540. Notes: All CVE users should reference CVE-2016-10540 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10542. Reason: This candidate is a reservation duplicate of CVE-2016-10542. Notes: All CVE users should reference CVE-2016-10542 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
[https://access.redhat.com/security/cve/cve-2016-1000030]
[https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe]
[https://pidgin.im/news/security/?id=91]
[GLSA-201701-38]
[https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/]
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Per Apache: "Having reviewed your report we have concluded that it does not represent a valid vulnerability in Apache Commons File Upload. If an application deserializes data from an untrusted source without filtering and/or validation that is an application vulnerability not a vulnerability in the library a potential attacker might leverage."
[openSUSE-SU-2019:1399]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[93604]
[http://www.zerodayinitiative.com/advisories/ZDI-16-570/]
[https://issues.apache.org/jira/browse/FILEUPLOAD-279]
[https://issues.apache.org/jira/browse/WW-4812]
[[announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior]
[https://security.netapp.com/advisory/ntap-20190212-0001/]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
[https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[https://www.tenable.com/security/research/tra-2016-12]
[https://www.tenable.com/security/research/tra-2016-23]
[https://www.tenable.com/security/research/tra-2016-30]
TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.
[https://bugzilla.redhat.com/show_bug.cgi?id=1316083]
[https://patrick.uiterwijk.org/2016/03/09/fedora-spam-dwf-2016-89000/]
Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.
[https://bugzilla.gnome.org/show_bug.cgi?id=754488]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5385. Reason: This candidate is a duplicate of CVE-2016-5385. Notes: All CVE users should reference CVE-2016-5385 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5386. Reason: This candidate is a duplicate of CVE-2016-5386. Notes: All CVE users should reference CVE-2016-5386 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5387. Reason: This candidate is a duplicate of CVE-2016-5387. Notes: All CVE users should reference CVE-2016-5387 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5388. Reason: This candidate is a duplicate of CVE-2016-5388. Notes: All CVE users should reference CVE-2016-5388 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
[93967]
[http://www.vapidlabs.com/advisory.php?v=163]
XSS and SQLi in huge IT gallery v1.1.5 for Joomla
[http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-pro]
[92102]
[http://www.vapidlabs.com/advisory.php?v=164]
XSS in huge IT gallery v1.1.5 for Joomla
[http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-pro]
[92102]
[http://www.vapidlabs.com/advisory.php?v=164]
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
[http://huge-it.com/joomla-portfolio-gallery/]
[93821]
[http://www.vapidlabs.com/advisory.php?v=165]
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
[http://huge-it.com/joomla-portfolio-gallery/]
[93821]
[http://www.vapidlabs.com/advisory.php?v=165]
XSS & SQLi in HugeIT slideshow v1.0.4
[http://extensions.joomla.org/extensions/extension/photos-a-images/slideshow/slideshow]
[93822]
[http://www.vapidlabs.com/advisory.php?v=166]
XSS & SQLi in HugeIT slideshow v1.0.4
[http://extensions.joomla.org/extensions/extension/photos-a-images/slideshow/slideshow]
[93822]
[http://www.vapidlabs.com/advisory.php?v=166]
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
[http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog]
[92185]
[http://www.vapidlabs.com/advisory.php?v=167]
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
[http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog]
[92185]
[http://www.vapidlabs.com/advisory.php?v=167]
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
[http://extensions.joomla.org/extensions/extension/photos-a-images/slider]
[92160]
[http://www.vapidlabs.com/advisory.php?v=168]
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
[http://extensions.joomla.org/extensions/extension/photos-a-images/slider]
[92160]
[http://www.vapidlabs.com/advisory.php?v=168]
Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
[http://huge-it.com/joomla-video-gallery/]
[93107]
[http://www.vapidlabs.com/advisory.php?v=169]
[42596]
Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
[http://huge-it.com/joomla-portfolio-gallery/]
[93268]
[http://www.vapidlabs.com/advisory.php?v=170]
[42597]
Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
[http://huge-it.com/joomla-catalog/]
[http://www.vapidlabs.com/advisory.php?v=171]
[42598]
Reflected XSS in wordpress plugin admin-font-editor v1.8
[93896]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=526]
[https://wordpress.org/plugins/admin-font-editor]
Reflected XSS in wordpress plugin ajax-random-post v2.00
[93895]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=494]
[https://wordpress.org/plugins/ajax-random-post]
Reflected XSS in wordpress plugin anti-plagiarism v3.60
[93890]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=161]
[https://wordpress.org/plugins/anti-plagiarism]
Reflected XSS in wordpress plugin defa-online-image-protector v3.3
[93892]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=449]
[https://wordpress.org/plugins/defa-online-image-protector]
Reflected XSS in wordpress plugin e-search v1.0
[http://www.vapidlabs.com/wp/wp_advisory.php?v=394]
[https://wordpress.org/plugins/e-search]
Reflected XSS in wordpress plugin e-search v1.0
[93867]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=393]
[https://wordpress.org/plugins/e-search]
Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
[93865]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=37]
[https://wordpress.org/plugins/enhanced-tooltipglossary]
Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
[93869]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=602]
[https://wordpress.org/plugins/forget-about-shortcode-buttons]
Reflected XSS in wordpress plugin hdw-tube v1.2
[93868]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=530]
[https://wordpress.org/plugins/hdw-tube]
Reflected XSS in wordpress plugin hdw-tube v1.2
[93820]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=533]
[https://wordpress.org/plugins/hdw-tube]
Reflected XSS in wordpress plugin heat-trackr v1.0
[93818]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=798]
[https://wordpress.org/plugins/heat-trackr]
Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
[93815]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=658]
[https://wordpress.org/plugins/hero-maps-pro]
Reflected XSS in wordpress plugin indexisto v1.0.5
[93816]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=38]
[https://wordpress.org/plugins/indexisto]
Reflected XSS in wordpress plugin infusionsoft v1.5.11
[93819]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=864]
[https://wordpress.org/plugins/infusionsoft]
Reflected XSS in wordpress plugin new-year-firework v1.1.9
[93817]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=453]
[https://wordpress.org/plugins/new-year-firework]
Reflected XSS in wordpress plugin page-layout-builder v1.9.3
[93804]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=358]
[https://wordpress.org/plugins/page-layout-builder]
Reflected XSS in wordpress plugin parsi-font v4.2.5
[93802]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=435]
[https://wordpress.org/plugins/parsi-font]
Reflected XSS in wordpress plugin photoxhibit v2.1.8
[93803]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=780]
[https://wordpress.org/plugins/photoxhibit]
Reflected XSS in wordpress plugin photoxhibit v2.1.8
[93585]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=778]
[https://wordpress.org/plugins/photoxhibit]
Reflected XSS in wordpress plugin pondol-carousel v1.0
[93586]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=524]
[https://wordpress.org/plugins/pondol-carousel]
Reflected XSS in wordpress plugin pondol-formmail v1.1
[93584]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=787]
[https://wordpress.org/plugins/pondol-formmail]
Reflected XSS in wordpress plugin recipes-writer v1.0.4
[93589]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=380]
[https://wordpress.org/plugins/recipes-writer]
Reflected XSS in wordpress plugin s3-video v0.983
[93583]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=240]
[https://wordpress.org/plugins/s3-video]
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
[93582]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=474]
[https://wordpress.org/plugins/simpel-reserveren]
Reflected XSS in wordpress plugin simplified-content v1.0.0
[93581]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=853]
[https://wordpress.org/plugins/simplified-content]
Reflected XSS in wordpress plugin tera-charts v1.0
[93580]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=455]
[https://wordpress.org/plugins/tera-charts]
Reflected XSS in wordpress plugin tidio-form v1.0
[93579]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=799]
[https://wordpress.org/plugins/tidio-form]
Reflected XSS in wordpress plugin tidio-gallery v1.1
[93543]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=427]
[https://wordpress.org/plugins/tidio-gallery]
Reflected XSS in wordpress plugin whizz v1.0.7
[93538]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=112]
[https://wordpress.org/plugins/whizz]
Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
[93536]
[http://www.vapidlabs.com/wp/wp_advisory.php?v=303]
[https://wordpress.org/plugins/wpsolr-search-engine]
Mailcwp remote file upload vulnerability incomplete fix v1.100
[http://www.vapidlabs.com/advisory.php?v=175]
[https://wordpress.org/plugins/mailcwp/]
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
[RHSA-2017:0182]
[RHSA-2017:0183]
[DSA-3745]
[[oss-security] 20161217 Re: CVE Request - squid HTTP proxy multiple Information Disclosure issues]
[94953]
[1037513]
[http://www.squid-cache.org/Advisories/SQUID-2016_11.txt]
Ruckus Wireless H500 web management interface CSRF
[http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt]
[https://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/]
Ruckus Wireless H500 web management interface authentication bypass
[http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt]
[https://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/]
Ruckus Wireless H500 web management interface denial of service
[http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt]
[https://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/]
Ruckus Wireless H500 web management interface authenticated command injection
[http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt]
[93539]
[http://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/]
[https://bitbucket.org/dudux/ruckus-rootshell]
Zotpress plugin for WordPress SQLi in zp_get_account()
[93894]
[https://wordpress.org/plugins/zotpress/changelog/]
[https://wordpress.org/support/topic/sql-injection-in-api_user_id/]
Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page.
[99253]
[https://www.elastic.co/community/security]
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
[99178]
[https://www.elastic.co/community/security]
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
[99179]
[https://www.elastic.co/community/security]
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
[99126]
[https://www.elastic.co/community/security]
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.
[https://www.elastic.co/community/security]
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
[RHSA-2016:2101]
[RHSA-2017:2912]
[https://access.redhat.com/security/cve/cve-2016-1000232]
[https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae]
[https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534]
[https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/]
[https://www.npmjs.com/advisories/130]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10325. Reason: This candidate is a reservation duplicate of CVE-2016-10325. Notes: All CVE users should reference CVE-2016-10325 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10326. Reason: This candidate is a reservation duplicate of CVE-2016-10326. Notes: All CVE users should reference CVE-2016-10326 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-7510. Reason: This candidate is a reservation duplicate of CVE-2016-7510. Notes: All CVE users should reference CVE-2016-7510 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.
[https://packetstormsecurity.com/files/140141/Joomla-DT-Register-SQL-Injection.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000010. Reason: This candidate is a duplicate of CVE-2017-1000010. Notes: All CVE users should reference CVE-2017-1000010 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
[https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py]
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.
[[oss-security] 20161217 Re: CVE Request - squid HTTP proxy multiple Information Disclosure issues]
[94953]
[1037512]
[http://www.squid-cache.org/Advisories/SQUID-2016_10.txt]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1000307. Reason: This candidate is a reservation duplicate of CVE-2016-1000307. Notes: All CVE users should reference CVE-2016-1000307 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to ProfileSettings page; (2) note parameter to PersonalNotes Section; (3) closed_msg, description, allowed_types parameters to WebsiteConfigurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673.
[https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/DWF/2016/1000307/CVE-2016-1000307.json]
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[USN-3727-1]
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/413b42f4d770456508585c830cfcde95f9b0e93b#diff-54656f860db94b867ba7542430cd2ef0]
[https://github.com/bcgit/bc-java/commit/8a73f08931450c17c749af067b6a8185abdfd2c0#diff-494fb066bed02aeb76b6c005632943f2]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/790642084c4e0cadd47352054f868cc8397e2c00#diff-e5934feac8203ca0104ab291a3560a31]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937]
[[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
[USN-3727-1]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10211. Reason: This candidate is a reservation duplicate of CVE-2016-10211. Notes: All CVE users should reference CVE-2016-10211 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10209. Reason: This candidate is a reservation duplicate of CVE-2016-10209. Notes: All CVE users should reference CVE-2016-10209 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10222. Reason: This candidate is a reservation duplicate of CVE-2016-10222. Notes: All CVE users should reference CVE-2016-10222 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10226. Reason: This candidate is a reservation duplicate of CVE-2016-10226. Notes: All CVE users should reference CVE-2016-10226 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
[RHSA-2018:2669]
[RHSA-2018:2927]
[https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f]
[https://security.netapp.com/advisory/ntap-20181127-0004/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9847. Reason: This candidate is a reservation duplicate of CVE-2016-9847. Notes: All CVE users should reference CVE-2016-9847 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9848. Reason: This candidate is a reservation duplicate of CVE-2016-9848. Notes: All CVE users should reference CVE-2016-9848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9849. Reason: This candidate is a reservation duplicate of CVE-2016-9849. Notes: All CVE users should reference CVE-2016-9849 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9850. Reason: This candidate is a reservation duplicate of CVE-2016-9850. Notes: All CVE users should reference CVE-2016-9850 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9851. Reason: This candidate is a reservation duplicate of CVE-2016-9851. Notes: All CVE users should reference CVE-2016-9851 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, CVE-2016-9855. Reason: This candidate is a reservation duplicate of CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and CVE-2016-9855. Notes: All CVE users should reference CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and/or CVE-2016-9855 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9856, CVE-2016-9857. Reason: This candidate is a reservation duplicate of CVE-2016-9856 and CVE-2016-9857. Notes: All CVE users should reference CVE-2016-9856 and/or CVE-2016-9857 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9858, CVE-2016-9859, CVE-2016-9860. Reason: This candidate is a reservation duplicate of CVE-2016-9858, CVE-2016-9859, and CVE-2016-9860. Notes: All CVE users should reference CVE-2016-9858, CVE-2016-9859, and/or CVE-2016-9860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9861. Reason: This candidate is a reservation duplicate of CVE-2016-9861. Notes: All CVE users should reference CVE-2016-9861 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9862. Reason: This candidate is a reservation duplicate of CVE-2016-9862. Notes: All CVE users should reference CVE-2016-9862 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9863. Reason: This candidate is a reservation duplicate of CVE-2016-9863. Notes: All CVE users should reference CVE-2016-9863 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9864. Reason: This candidate is a reservation duplicate of CVE-2016-9864. Notes: All CVE users should reference CVE-2016-9864 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9865. Reason: This candidate is a reservation duplicate of CVE-2016-9865. Notes: All CVE users should reference CVE-2016-9865 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9866. Reason: This candidate is a reservation duplicate of CVE-2016-9866. Notes: All CVE users should reference CVE-2016-9866 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10220. Reason: This candidate is a reservation duplicate of CVE-2016-10220. Notes: All CVE users should reference CVE-2016-10220 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd requests, aka SAP Security Note 2344524.
[http://packetstormsecurity.com/files/140232/SAP-Solman-7.31-Information-Disclosure.html]
[20161220 [ERPSCAN-16-035] SAP Solman - user accounts disclosure]
[92949]
[https://erpscan.io/advisories/erpscan-16-035-sap-solman-user-accounts-dislosure/]
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
[95101]
[1037532]
[https://github.com/nahsra/antisamy/issues/2]
SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.
[https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html]
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.
[https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html]
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
[http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html]
[[oss-security] 20161219 Announce: OpenSSH 7.4 released]
[94968]
[1037490]
[http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637]
[RHSA-2017:2029]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1009]
[https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5]
[[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update]
[FreeBSD-SA-17:01]
[https://security.netapp.com/advisory/ntap-20171130-0002/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us]
[USN-3538-1]
[40963]
[https://www.openssh.com/txt/release-7.4]
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39609]
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
[http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html]
[[oss-security] 20161219 Announce: OpenSSH 7.4 released]
[94972]
[1037490]
[http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1010]
[https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce]
[FreeBSD-SA-17:01]
[https://security.netapp.com/advisory/ntap-20171130-0002/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us]
[40962]
[https://www.openssh.com/txt/release-7.4]
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
[[oss-security] 20161219 Announce: OpenSSH 7.4 released]
[94977]
[1037490]
[http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637]
[RHSA-2017:2029]
[https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9]
[[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update]
[https://security.netapp.com/advisory/ntap-20171130-0002/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us]
[https://www.openssh.com/txt/release-7.4]
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.
[[oss-security] 20161219 Announce: OpenSSH 7.4 released]
[94975]
[1037490]
[http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637]
[RHSA-2017:2029]
[https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9]
[[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update]
[https://security.netapp.com/advisory/ntap-20171130-0002/]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us]
[https://www.openssh.com/txt/release-7.4]
Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
[DSA-3847]
[94963]
[1037491]
[http://xenbits.xen.org/xsa/advisory-204.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1005.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
[39608]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.
[DSA-3847]
[95021]
[1037517]
[http://xenbits.xen.org/xsa/advisory-202.html]
[GLSA-201612-56]
[https://support.citrix.com/article/CTX219378]
VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.
[95026]
[1037518]
[http://xenbits.xen.org/xsa/advisory-203.html]
[https://support.citrix.com/article/CTX219378]
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
[http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/]
[DSA-3760]
[[oss-security] 20161221 Re: CVE request: ikiwiki: authorization bypass when reverting changes]
[[oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery)]
[https://ikiwiki.info/security/#index46h2]
Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.
[[oss-security] 20161222 Re: CVE Request: Smack: TLS SecurityMode.required not always enforced, leading to striptls attack]
[95129]
[https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22]
[https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820b]
[https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04]
[https://issues.igniterealtime.org/projects/SMACK/issues/SMACK-739]
[FEDORA-2016-897a1e6698]
The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
[http://git.qemu-project.org/?p=qemu.git;a=commit;h=abd7f08b2353f43274b785db8c7224f082ef4d31]
[[oss-security] 20161220 CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities]
[[oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities]
[94981]
[1037525]
[[qemu-devel] 20161214 [PATCH] display: virtio-gpu-3d: check virgl capabilities max_size]
[GLSA-201701-49]
The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
[http://git.qemu-project.org/?p=qemu.git;a=commit;h=2fe760554eb3769d70f608a158474f]
[http://git.qemu-project.org/?p=qemu.git;a=commit;h=acfc4846508a02cc4c83aa27799fd7]
[[oss-security] 20161220 CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout]
[[oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout]
[94978]
[1037526]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10033. Reason: This candidate is a duplicate of CVE-2016-10033. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2016-10033 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.
[95299]
[https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee]
[https://www.schedmd.com/news.php?id=178]
** DISPUTED ** WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts, the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer."
[http://forum.wampserver.com/read.php?2,144473]
[https://packetstormsecurity.com/files/140279/Wampserver-3.0.6-Privilege-Escalation.html]
[https://sourceforge.net/p/wampserver/bugs/52/]
[40967]
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
[http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html]
[http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html]
[20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]]
[http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection]
[20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]]
[95108]
[1037533]
[https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html]
[https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18]
[https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities]
[https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html]
[https://www.drupal.org/psa-2016-004]
[40968]
[40969]
[40970]
[40974]
[40986]
[41962]
[41996]
[42024]
[42221]
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
[95144]
[1037539]
[https://framework.zend.com/security/advisory/ZF2016-04]
[https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html]
[GLSA-201804-10]
[40979]
[40986]
[42221]
Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.
[http://packetstormsecurity.com/files/147378/Jfrog-Artifactory-Code-Execution-Shell-Upload.html]
[44543]
[https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory4.16]
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter, related to browser/directory/getlist.
[95127]
[https://github.com/modxcms/revolution/pull/13177]
[https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt]
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.
[95097]
[https://github.com/modxcms/revolution/pull/13177]
[https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt]
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.
[95096]
[https://github.com/modxcms/revolution/pull/13177]
[https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.
[[oss-security] 20161224 Re: Qt QXmlSimpleReader]
[[oss-security] 20170114 Re: [Security] Qt QXmlSimpleReader]
[95113]
[https://bugzilla.redhat.com/show_bug.cgi?id=1409597]
An issue was discovered in Sprecher Automation SPRECON-E Service Program before 3.43 SP0. Under certain preconditions, it is possible to execute telegram simulation as a non-admin user. As prerequisites, a user must have created an online-connection, validly authenticated and authorized as administrator, and executed telegram simulation. After that, the online-connection must have been closed. Incorrect caching of client data then may lead to privilege escalation, where a subsequently acting non-admin user is permitted to do telegram simulation. In order to exploit this vulnerability, a potential attacker would need to have both a valid engineering-account in the SPRECON RBAC system as well as access to a service/maintenance computer with SPRECON-E Service Program running. Additionally, a valid admin-user must have closed the service connection beforehand without closing the program, having executed telegram simulation; the attacker then has access to the running software instance. Hence, there is no risk from external attackers.
[95296]
[https://www.sprecher-automation.com/en/it-security/]
Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request, leading to denial of service and information disclosure.
[https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2016-10042.txt]
An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application's responses. Attackers could execute unauthorized commands, which could then be used to disable the software, or read, write, and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner (apache user).
[41179]
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=22f6b4d34fcf039c63a94e7670e0da24f8575a5a]
[http://source.android.com/security/bulletin/2017-02-01.html]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.7]
[96122]
[1037798]
[https://github.com/torvalds/linux/commit/22f6b4d34fcf039c63a94e7670e0da24f8575a5a]
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
[[oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033]]
[http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html]
[http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html]
[20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)]
[http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection]
[20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch)]
[95130]
[1037533]
[https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html]
[https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20]
[https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities]
[https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html]
[40969]
[40986]
[42221]
Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95183]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410448]
[https://github.com/ImageMagick/ImageMagick/commit/989f9f88ea6db09b99d25586e912c921c0da8d3f]
Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95182]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410449]
[https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb]
Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95186]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410451]
[https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb]
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95180]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410452]
[https://github.com/ImageMagick/ImageMagick/commit/3e9165285eda6e1bb71172031d3048b51bb443a4]
[https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29710]
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1002.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84311]
[1035251]
[http://www.zerodayinitiative.com/advisories/ZDI-16-192/]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Heap-based buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.9.4-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95185]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410454]
[https://github.com/ImageMagick/ImageMagick/commit/73fb0aac5b958521e1511e179ecc0ad49f70ebaf]
Use-after-free vulnerability in the ReadPWPImage function in coders/pwp.c in ImageMagick 6.9.5-5 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95187]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410456]
[https://github.com/ImageMagick/ImageMagick/commit/ecc03a2518c2b7dd375fde3a040fdae0bdf6a521]
[https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30245]
Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95181]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410459]
[https://github.com/ImageMagick/ImageMagick/commit/9e187b73a8a1290bb0e1a1c878f8be1917aa8742]
The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95179]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410461]
[https://github.com/ImageMagick/ImageMagick/commit/f983dcdf9c178e0cbc49608a78713c5669aa1bb5]
Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95191]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410462]
[https://github.com/ImageMagick/ImageMagick/commit/10b3823a7619ed22d42764733eb052c4159bc8c1]
Buffer overflow in the WritePDBImage function in coders/pdb.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95193]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410464]
[https://github.com/ImageMagick/ImageMagick/commit/10b3823a7619ed22d42764733eb052c4159bc8c1]
Buffer overflow in the sixel_decode function in coders/sixel.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95190]
[95191]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410465]
[https://github.com/ImageMagick/ImageMagick/commit/10b3823a7619ed22d42764733eb052c4159bc8c1]
Buffer overflow in the WriteGROUP4Image function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95192]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410466]
[https://github.com/ImageMagick/ImageMagick/commit/10b3823a7619ed22d42764733eb052c4159bc8c1]
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95212]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410467]
[https://github.com/ImageMagick/ImageMagick/commit/4ec444f4eab88cf4bec664fafcf9cab50bc5ff6a]
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.4-1 allows remote attackers to cause a denial of service (application crash) or have unspecified other impact via a crafted TIFF file.
[openSUSE-SU-2017:0391]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95206]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410469]
[https://github.com/ImageMagick/ImageMagick/commit/58cf5bf4fade82e3b510e8f3463a967278a3e410]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[1035509]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95208]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410470]
[https://github.com/ImageMagick/ImageMagick/commit/933e96f01a8c889c7bf5ffd30020e86a02a046e7]
[https://github.com/ImageMagick/ImageMagick/issues/196]
The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95207]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410471]
[https://github.com/ImageMagick/ImageMagick/commit/4e914bbe371433f0590cefdf3bd5f3a5710069f9]
[https://github.com/ImageMagick/ImageMagick/issues/196]
The ReadGROUP4Image function in coders/tiff.c in ImageMagick does not check the return value of the fwrite function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
[DSA-3799]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95209]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410473]
[https://github.com/ImageMagick/ImageMagick/issues/196]
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95210]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410476]
[https://github.com/ImageMagick/ImageMagick/commit/2bb6941a2d557f26a2f2049ade466e118eeaab91]
Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[openSUSE-SU-2017:0391]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95211]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410478]
[https://github.com/ImageMagick/ImageMagick/commit/f8877abac8e568b2f339cca70c2c3c1b6eaec288]
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
[openSUSE-SU-2017:0391]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95213]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410482]
[https://github.com/ImageMagick/ImageMagick/commit/134463b926fa965571aa4febd61b810be5e7da05]
[https://github.com/ImageMagick/ImageMagick/issues/129]
Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95217]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410491]
[https://github.com/ImageMagick/ImageMagick/commit/f6e9d0d9955e85bdd7540b251cd50d598dacc5e6]
magick/memory.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via vectors involving "too many exceptions," which trigger a buffer overflow.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95220]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410494]
[https://github.com/ImageMagick/ImageMagick/commit/0474237508f39c4f783208123431815f1ededb76]
The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95219]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410500]
[https://github.com/ImageMagick/ImageMagick/commit/56d6e20de489113617cbbddaf41e92600a34db22]
[https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=30797]
coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.
[openSUSE-SU-2017:0391]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95216]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410507]
[https://github.com/ImageMagick/ImageMagick/commit/8a370f9ab120faf182aa160900ba692ba8e2bcf0]
Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1009.
[84215]
[1035199]
[http://www.zerodayinitiative.com/advisories/ZDI-16-189]
[https://helpx.adobe.com/security/products/acrobat/apsb16-09.html]
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
[openSUSE-SU-2017:0391]
[openSUSE-SU-2017:0399]
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95221]
[https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1545366]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410510]
[https://github.com/ImageMagick/ImageMagick/commit/b173a352397877775c51c9a0e9d59eb6ce24c455]
coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
[[oss-security] 20161226 Re: CVE requests for various ImageMagick issues]
[95222]
[https://bugzilla.redhat.com/show_bug.cgi?id=1410513]
[https://github.com/ImageMagick/ImageMagick/commit/f3b483e8b054c50149912523b4773687e18afe25]
** DISPUTED ** WampServer 3.0.6 has two files called 'wampmanager.exe' and 'unins000.exe' with a weak ACL for Modify. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called wampmanager.exe or unins000.exe and replace the original files. The next time one of these programs is launched by a more privileged user, malicious code chosen by the local attacker will run. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer."
[http://forum.wampserver.com/read.php?2,144473]
[https://packetstormsecurity.com/files/138948/wampserver306-insecure.txt]
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
[http://packetstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.html]
[https://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.html]
[https://open.vanillaforums.com/discussion/33498/critical-security-release-vanilla-2-3-1]
[41996]
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.
[http://packetstormsecurity.com/files/140290/SwiftMailer-Remote-Code-Execution.html]
[20161229 SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)]
[DSA-3769]
[95140]
[https://github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES]
[https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html]
[40972]
[40986]
[42221]
The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
[[oss-security] 20161228 Re: tqdm: insecure use of git]
[95143]
[https://github.com/tqdm/tqdm/issues/328]
[GLSA-201807-01]
SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515.
[41030]
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
[84216]
[1035199]
[http://www.zerodayinitiative.com/advisories/ZDI-16-190]
[https://helpx.adobe.com/security/products/acrobat/apsb16-09.html]
/usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Run a plugin" action.
[95351]
[https://bugs.launchpad.net/shutter/+bug/1652600]
[41435]
include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-time installation because it fails to sanitize the dbType POST parameter before adding it to an include() call in the bundled-libs/serendipity_generateFTPChecksums.php file.
[95165]
[https://github.com/s9y/Serendipity/commit/bba6a840f4d53cbaf62971a3078a98c8ddf92b85]
[https://github.com/s9y/Serendipity/issues/433]
Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case.
[95166]
[https://github.com/Piwigo/Piwigo/commit/7df3830c81716b959a2d0d3a0d8216b860ae0dc7]
[https://github.com/Piwigo/Piwigo/issues/575]
admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
[95164]
[https://github.com/Piwigo/Piwigo/commit/9dd92959f6975099e0c62163a846a4648a6a920f]
[https://github.com/Piwigo/Piwigo/issues/572#issuecomment-268252202]
admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.
[95167]
[https://github.com/Piwigo/Piwigo/commit/4b33a0fd199fd445b15a49927ea6a9a153e3877d]
[https://github.com/Piwigo/Piwigo/issues/573#issuecomment-267974558]
RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task information by leveraging incorrect permissions applied to a RESTful request.
[95366]
[1037583]
[https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20170109-01-security-notice-for-ca-service-desk-manager.html]
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
[[oss-security] 20161229 libpng NULL pointer dereference bugfix]
[[oss-security] 20161230 Re: libpng NULL pointer dereference bugfix]
[95157]
[GLSA-201701-74]
[USN-3712-1]
[USN-3712-2]
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=128394eff343fc6d2f32172f03e24829539c5835]
[RHSA-2017:0817]
[[oss-security] 20161230 Re: Linux Kernel use-after-free in SCSI generic device interface]
[95169]
[1037538]
[RHSA-2017:1842]
[RHSA-2017:2077]
[RHSA-2017:2669]
[https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835]
Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.
[[oss-security] 20161230 Re: CVE request: Nagios: Incomplete fix for CVE-2016-8641]
[95171]
Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1007.
[84215]
[1035199]
[http://www.zerodayinitiative.com/advisories/ZDI-16-191]
[https://helpx.adobe.com/security/products/acrobat/apsb16-09.html]
Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand function, (2) cmd_emboss function, or (3) cmd_engrave function.
[http://hg.savannah.gnu.org/hgweb/unrtf/rev/3b16893a6406]
[[oss-security] 20161231 Re: CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions]
[[oss-security] 20170101 Re: CVE Request: UnRTF: stack-based buffer overflows in cmd_* functions]
[95173]
[https://bugzilla.redhat.com/show_bug.cgi?id=1409546]
Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.
[http://bugzilla.maptools.org/show_bug.cgi?id=2620]
[http://bugzilla.maptools.org/show_bug.cgi?id=2622]
[DSA-3762]
[[oss-security] 20170101 Re: libtiff: multiple heap-based buffer overflow]
[[oss-security] 20170101 Re: Re: libtiff: multiple heap-based buffer overflow]
[95218]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0ba6a]
Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image, which triggers a heap-based buffer overflow.
[http://bugzilla.maptools.org/show_bug.cgi?id=2610]
[DSA-3762]
[[oss-security] 20170101 Re: libtiff: multiple heap-based buffer overflow]
[[oss-security] 20170101 Re: Re: libtiff: multiple heap-based buffer overflow]
[95215]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/787c0ee906430b772f33ca50b97b8b5ca070faec]
Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a crafted image.
[http://bugzilla.maptools.org/show_bug.cgi?id=2640]
[DSA-3762]
[[oss-security] 20170101 Re: libtiff: multiple heap-based buffer overflow]
[[oss-security] 20170101 Re: Re: libtiff: multiple heap-based buffer overflow]
[95214]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/c7153361a4041260719b340f73f2f76]
Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (crash) via a crafted TIFF file.
[http://bugzilla.maptools.org/show_bug.cgi?id=2625]
[DSA-3903]
[[oss-security] 20170101 Re: libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c)]
[[oss-security] 20170101 libtiff: stack-based buffer overflow in _TIFFVGetField (tif_dir.c)]
[95178]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow-in-_tiffvgetfield-tif_dir-c/]
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.
[http://www.hackersb.cn/shenji/107.html]
[95172]
[https://github.com/semplon/GeniXCMS/commit/d885eb20006099262c0278932b9f8aca3c1ac97f]
[https://github.com/semplon/GeniXCMS/issues/58]
XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.
[http://www.cloudscan.me/2016/03/xxe-dork-open-am-1010-xml-injection.html]
[95174]
[https://twitter.com/h02332/status/816252923688665088]
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary system commands.
[96129]
[https://niantech.io/blog/2017/02/05/vulns-multiple-vulns-in-sendquick-entera-avera-sms-gateway-appliances/]
Borg (aka BorgBackup) before 1.0.9 has a flaw in the cryptographic protocol used to authenticate the manifest (list of archives), potentially allowing an attacker to spoof the list of archives.
[http://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability]
[95205]
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
[SUSE-SU-2016:0715]
[SUSE-SU-2016:0716]
[openSUSE-SU-2016:0719]
[openSUSE-SU-2016:0734]
[84308]
[1035251]
[https://helpx.adobe.com/security/products/flash-player/apsb16-08.html]
[GLSA-201603-07]
Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recovery, potentially allowing an attacker to overwrite an archive.
[http://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability]
[95203]
Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover the encrypted password to access the Password Manager.
[96840]
[https://rastamouse.me/guff/2016/automize/]
hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords. All 10.x up to and including 10.25 and all 11.x up to and including 11.14 are verified to be affected.
[96848]
[https://rastamouse.me/guff/2016/automize/]
Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for GPG Encryption profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.
[96850]
[https://rastamouse.me/guff/2016/automize/]
Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for SSH/SFTP profiles. Verified in all 10.x versions up to and including 10.25, and all 11.x versions up to and including 11.14.
[96845]
[https://rastamouse.me/guff/2016/automize/]
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
[95202]
[https://github.com/Piwigo/Piwigo/commit/8796e43aa344681d92a92e1f9b985409d4f36e31]
[https://github.com/Piwigo/Piwigo/commit/9004fdfc0b4a11cb32e9e15a5f67e4ec827e82dc]
[https://github.com/Piwigo/Piwigo/issues/574#issuecomment-267938358]
Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 devices with firmware before 4.3.3-8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the thispage parameter, as demonstrated by reading the /etc/shadow file.
[http://kb.netgear.com/30739/Path-Traversal-Attack-Security-Vulnerability]
[95204]
[1037548]
[https://twitter.com/mantislesin/status/816618162770821120]
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header.
[95201]
[https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/]
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.
[95200]
[https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/]
Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after the handle has been released through the SCardReleaseContext function.
[DSA-3752]
[[oss-security] 20170103 Re: CVE Request: pcsc-lite use-after-free and double-free]
[95263]
[USN-3176-1]
[https://anonscm.debian.org/cgit/pcsclite/PCSC.git/commit/?id=697fe05967af7ea215bcd5d5774be587780c9e22]
[[pcsclite-muscle] 20161226 New pcsc-lite 1.8.20]
[GLSA-201702-01]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.
<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[http://packetstormsecurity.com/files/137050/Adobe-Flash-MovieClip.duplicateMovieClip-Use-After-Free.html]
[RHSA-2016:0610]
[85926]
[1035509]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
[39779]
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML by providing crafted tax-rate table values in CSV format.
[95292]
[https://wordpress.org/plugins/woocommerce/changelog/]
SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch.
[95293]
[https://github.com/qemm/joomlasqli]
[https://vel.joomla.org/resolved/1897-aweb-cart-watching-system-2-6-0]
[40973]
NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier have a default password of 12345678, which makes it easier for remote attackers to obtain access after a factory reset or in a factory configuration.
[http://blog.newskysecurity.com/2016/09/factory_reset_vuln_in_netgear_arlo/]
[http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability]
[95265]
NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier use a pattern of adjective, noun, and three-digit number for the customized password, which makes it easier for remote attackers to obtain access via a dictionary attack.
[http://blog.newskysecurity.com/2016/09/brute-force-vulnerability-netgear-arlo/]
[http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability]
[95266]
Firejail does not restrict access to --tmpfs, which allows local users to gain privileges, as demonstrated by mounting over /etc.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Firejail uses 0777 permissions when mounting /tmp, which allows local users to gain privileges.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privileges.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Firejail does not properly clean environment variables, which allows local users to gain privileges.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.
[[oss-security] 20170105 Re: Firejail local root exploit]
[[oss-security] 20170106 Re: Firejail local root exploit]
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.
[http://www.openwall.com/lists/oss-security/2014/12/15/5]
[http://www.openwall.com/lists/oss-security/2015/09/03/5]
[95404]
[https://github.com/lxc/lxc/commit/e986ea3dfa4a2957f71ae9bfaed406dd6e1ffff6]
[GLSA-201711-09]
D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking an HTTPS session.
[95329]
[https://labs.integrity.pt/advisories/dlink-dgs-1100-hardcoded-keys/]
Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.
[95412]
[https://www.splunk.com/view/SP-CAAAPSR]
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
[[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack]
[95376]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716]
[https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b]
[https://github.com/rohe/pysaml2/issues/366]
[https://github.com/rohe/pysaml2/pull/379]
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
[openSUSE-SU-2017:0397]
[openSUSE-SU-2017:0405]
[openSUSE-SU-2017:0484]
[[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[95338]
[https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2]
[https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834]
[https://libgit2.github.com/security/]
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
[openSUSE-SU-2017:0397]
[openSUSE-SU-2017:0405]
[openSUSE-SU-2017:0484]
[[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[95339]
[https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a]
[https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037]
[https://libgit2.github.com/security/]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.
<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85926]
[1035509]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
[39778]
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
[openSUSE-SU-2017:0397]
[openSUSE-SU-2017:0405]
[openSUSE-SU-2017:0484]
[[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6]
[95359]
[https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22]
[https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211]
[https://libgit2.github.com/security/]
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.
[96851]
[https://gist.github.com/Zenexer/40d02da5e07f151adeaeeaa11af9ab36]
[https://github.com/bcit-ci/CodeIgniter/issues/4963]
[https://github.com/bcit-ci/CodeIgniter/pull/4966]
regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to regular expression compilation.
[http://git.ghostscript.com/?p=mujs.git;h=fd003eceda531e13fbdd1aeb6e9c73156496e569]
[[oss-security] 20170112 CVE Request: MUJS null pointer dereference and Heap buffer overflow write]
[[oss-security] 20170112 Re: CVE Request: MUJS null pointer dereference and Heap buffer overflow write]
[https://bugs.ghostscript.com/show_bug.cgi?id=697381]
[FEDORA-2017-dc6023e849]
Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions.
[http://git.ghostscript.com/?p=mujs.git;a=commit;h=77ab465f1c394bb77f00966cd950650f3f53cb24]
[[oss-security] 20170112 CVE Request: MUJS null pointer dereference and Heap buffer overflow write]
[[oss-security] 20170112 Re: CVE Request: MUJS null pointer dereference and Heap buffer overflow write]
[https://bugs.ghostscript.com/show_bug.cgi?id=697401]
[FEDORA-2017-dc6023e849]
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
[DSA-3802]
[[oss-security] 20170112 CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"]
[[oss-security] 20170112 Re: CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"]
[95423]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936]
[https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html]
[https://support.zabbix.com/browse/ZBX-11023]
An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that contains the directories for the 4 types of logs is /sdcard/mtklog which makes them accessible to apps that require the READ_EXTERNAL_STORAGE permission. The GPS log contains the GPS coordinates of the user as well as a timestamp for the coordinates. The modem log contains AT commands and their parameters which allow the user's outgoing and incoming calls and text messages to be obtained. The network log is a tcpdump network capture. The mobile log contains the Android log, which is not available to third-party apps as of Android 4.1. The LG ID is LVE-SMP-160019.
[96846]
[https://lgsecurity.lge.com/security_updates.html]
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete files owned by the system user. The third-party app can modify the /data/system/users/0/settings_secure.xml file to add an app as a notification listener to be able to receive the text of notifications as they are received on the device. This also allows the /data/system/users/0/accounts.db to be read which contains authentication tokens for various accounts on the device. The third-party app can obtain privileged information and also modify files to obtain more privileges on the device.
[96854]
[https://www.kryptowire.com/adups_security_analysis.html]
[https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html]
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
[96852]
[https://www.kryptowire.com/adups_security_analysis.html]
[https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html]
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. The app has an exported broadcast receiver named com.adups.fota.sysoper.WriteCommandReceiver which any app on the device can interact with. Therefore, any app can send a command embedded in an intent which will be executed by the WriteCommandReceiver component which is executing as the system user. The third-party app, utilizing the WriteCommandReceiver, can perform the following actions: call a phone number, factory reset the device, take pictures of the screen, record the screen in a video, install applications, inject events, obtain the Android log, and others. In addition, the com.adups.fota.sysoper.TaskService component will make a request to a URL of http://rebootv5.adsunflower.com/ps/fetch.do where the commands in the String array with a key of sf in the JSON Object sent back by the server will be executed as the system user. Since the connection is made via HTTP, it is vulnerable to a MITM attack.
[96853]
[https://www.kryptowire.com/adups_security_analysis.html]
[https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html]
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups.fota.sysoper. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. Therefore, the app executing as the system user has been granted a number of powerful permissions even though they are not present in the com.adups.fota.sysoper app's AndroidManifest.xml file. This app provides the com.adups.fota app access to the user's call log, text messages, and various device identifiers through the com.adups.fota.sysoper.provider.InfoProvider component. The com.adups.fota app uses timestamps when it runs and is eligible to exfiltrate the user's PII every 72 hours. If 72 hours have passed since the value of the timestamp, then the exfiltration will be triggered by the user plugging in the device to charge or when they leave or enter a wireless network. The exfiltration occurs in the background without any user interaction.
[96858]
[https://www.kryptowire.com/adups_security_analysis.html]
[https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html]
Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.
<a href="https://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[http://packetstormsecurity.com/files/137532/Adobe-Flash-Player-DLL-Hijacking.html]
[RHSA-2016:0610]
[20160618 [CVE-2016-1014] Escalation of privilege via executable (un)installers of Flash Player]
[20160617 [CVE-2016-1014] Escalation of privilege via executable (un)installers of Flash Player]
[1035509]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
[http://seclists.org/bugtraq/2017/Feb/6]
[http://seclists.org/fulldisclosure/2017/Feb/11]
[96849]
[https://github.com/ZoneMinder/ZoneMinder/commit/71898df7565ed2a51dfe76a1cf30ddb81fc888ba]
[https://github.com/ZoneMinder/ZoneMinder/pull/1697]
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
[http://git.ghostscript.com/?p=mujs.git;h=fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045]
[95876]
[https://bugs.ghostscript.com/show_bug.cgi?id=697448]
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic.
[RHSA-2017:0817]
[95797]
[1038256]
[https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730]
[https://support.f5.com/csp/article/K57211290?utm_source=f5support&utm_medium=RSS]
[https://tools.ietf.org/html/draft-ietf-6man-deprecate-atomfrag-generation-08]
[https://tools.ietf.org/html/rfc8021]
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
[96787]
[https://dev.tiki.org/item6174]
[https://sourceforge.net/p/tikiwiki/code/60308/]
coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.
[DSA-3799]
[[oss-security] 20170116 CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[[oss-security] 20170116 Re: CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[95750]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851485]
[https://github.com/ImageMagick/ImageMagick/commit/97566cf2806c0a5a86e884c96831a0c3b1ec6c20]
[GLSA-201702-09]
Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
[DSA-3799]
[[oss-security] 20170116 CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[[oss-security] 20170116 Re: CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[95749]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851483]
[https://github.com/ImageMagick/ImageMagick/commit/d23beebe7b1179fb75db1e85fbca3100e49593d9]
[GLSA-201702-09]
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
[DSA-3799]
[[oss-security] 20170116 CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[[oss-security] 20170116 Re: CVE Request: Imagemagick: various flaws: memory corruption, out-of-bounds writes, memory leaks, double-frees, off-by-one errors]
[95744]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851380]
[https://github.com/ImageMagick/ImageMagick/commit/aeff00de228bc5a158c2a975ab47845d8a1db456]
[GLSA-201702-09]
crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5).
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48a992727d82cb7db076fa15d372178743b1f4cd]
[[linux-crypto] 20161202 Crash in crypto mcryptd]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.15]
[[oss-security] 20170117 CVE request -- linux kernel: crash by spawning mcrypt(alg) with incompatible algorithm]
[95677]
[RHSA-2017:1842]
[RHSA-2017:2077]
[https://bugzilla.redhat.com/show_bug.cgi?id=1404200]
[https://github.com/torvalds/linux/commit/48a992727d82cb7db076fa15d372178743b1f4cd]
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
[[oss-security] 20160820 Path traversal vulnerability in WordPress Core Ajax handlers]
[96847]
[https://core.trac.wordpress.org/changeset/38168]
[https://core.trac.wordpress.org/ticket/37490]
[https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html]
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
[DSA-3759]
[[oss-security] 20170119 Re: CVE request: python-pysaml2 XML external entity attack]
[97692]
[RHSA-2017:0936]
[RHSA-2017:0937]
[RHSA-2017:0938]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850716]
[https://github.com/rohe/pysaml2/commit/6e09a25d9b4b7aa7a506853210a9a14100b8bc9b]
[https://github.com/rohe/pysaml2/issues/366]
[https://github.com/rohe/pysaml2/pull/379]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different vulnerability than CVE-2016-1019.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85930]
[1035509]
[http://www.zerodayinitiative.com/advisories/ZDI-16-227/]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0f1d21c1ccb1da66629627a74059dd7f5ac9c61]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.13]
[[oss-security] 20170118 CVE request Kernel: kvm: use-after-free issue while creating devices]
[95672]
[https://bugzilla.redhat.com/show_bug.cgi?id=1414506]
[https://github.com/torvalds/linux/commit/a0f1d21c1ccb1da66629627a74059dd7f5ac9c61]
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.
[[oss-security] 20170120 Re: CVE Request: two flaws in hesiod permitting privilege elevation]
[90952]
[https://bugzilla.redhat.com/show_bug.cgi?id=1332508]
[https://github.com/achernya/hesiod/pull/9]
[GLSA-201805-01]
The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
[[oss-security] 20170120 Re: CVE Request: two flaws in hesiod permitting privilege elevation]
[90952]
[https://bugzilla.redhat.com/show_bug.cgi?id=1332493]
[https://github.com/achernya/hesiod/pull/10]
[GLSA-201805-01]
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a45f795c65b479b4ba107b6ccde29b896d51ee98]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6]
[[oss-security] 20170120 Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel]
[95713]
[https://bugzilla.redhat.com/show_bug.cgi?id=1416101]
[https://github.com/torvalds/linux/commit/a45f795c65b479b4ba107b6ccde29b896d51ee98]
The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06deeec77a5a689cc94b21a8a91a76e42176685d]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.1]
[[oss-security] 20170120 Re: CVE REQUEST: linux kernel: process with pgid zero able to crash kernel]
[95714]
[https://bugzilla.redhat.com/show_bug.cgi?id=1416104]
[https://github.com/torvalds/linux/commit/06deeec77a5a689cc94b21a8a91a76e42176685d]
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
[http://git.qemu.org/?p=qemu.git;a=commit;h=eb7a20a3616085d46aa6b4b4224e15587ec67e6e]
[[oss-security] 20170120 CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb]
[[oss-security] 20170120 Re: CVE request Qemu: watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb]
[95770]
[RHSA-2017:2392]
[RHSA-2017:2408]
[[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update]
[GLSA-201702-28]
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
[95790]
[1037686]
[https://bugzilla.suse.com/show_bug.cgi?id=1020601]
[https://github.com/systemd/systemd/commit/06eeacb6fe029804f296b065b3ce91e796e1cd0e]
[https://github.com/systemd/systemd/commit/ee735086f8670be1591fa9593e80dd60163a7a2f]
[41171]
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space.
[95995]
[https://packetstormsecurity.com/files/140366/Akamai-NetSession-1.9.3.1-DLL-Hijacking.html]
The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
[http://php.net/ChangeLog-5.php]
[http://php.net/ChangeLog-7.php]
[DSA-3783]
[95764]
[1037659]
[RHSA-2018:1296]
[https://bugs.php.net/bug.php?id=73737]
[https://github.com/php/php-src/commit/1cda0d7c2ffb62d8331c64e703131d9cabdc03ea]
[GLSA-201702-29]
[https://security.netapp.com/advisory/ntap-20180112-0001/]
[https://www.tenable.com/security/tns-2017-04]
Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
[http://php.net/ChangeLog-5.php]
[http://php.net/ChangeLog-7.php]
[DSA-3783]
[95774]
[1037659]
[RHSA-2018:1296]
[https://bugs.php.net/bug.php?id=73764]
[https://github.com/php/php-src/commit/ca46d0acbce55019b970fcd4c1e8a10edfdded93]
[GLSA-201702-29]
[https://security.netapp.com/advisory/ntap-20180112-0001/]
[https://www.tenable.com/security/tns-2017-04]
Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1017, and CVE-2016-1031.
<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85926]
[1035509]
[http://www.zerodayinitiative.com/advisories/ZDI-16-226/]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
[http://php.net/ChangeLog-5.php]
[http://php.net/ChangeLog-7.php]
[DSA-3783]
[95783]
[1037659]
[RHSA-2018:1296]
[https://bugs.php.net/bug.php?id=73768]
[https://github.com/php/php-src/commit/b28b8b2fee6dfa6fcd13305c581bb835689ac3be]
[GLSA-201702-29]
[https://security.netapp.com/advisory/ntap-20180112-0001/]
[https://www.tenable.com/security/tns-2017-04]
The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
[http://php.net/ChangeLog-5.php]
[http://php.net/ChangeLog-7.php]
[DSA-3783]
[95768]
[1037659]
[RHSA-2018:1296]
[https://bugs.php.net/bug.php?id=73825]
[https://github.com/php/php-src/commit/16b3003ffc6393e250f069aa28a78dc5a2c064b2]
[GLSA-201702-29]
[https://security.netapp.com/advisory/ntap-20180112-0001/]
[https://www.tenable.com/security/tns-2017-04]
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
[http://php.net/ChangeLog-7.php]
[95668]
[1037659]
[RHSA-2018:1296]
[https://bugs.php.net/bug.php?id=73831]
[https://github.com/php/php-src/commit/8d2539fa0faf3f63e1d1e7635347c5b9e777d47b]
Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) by repeatedly creating a decode context.
[[oss-security] 20170124 CVE request Virglrenderer: host memory leakage when creating decode context]
[[oss-security] 20170125 Re: CVE request Virglrenderer: host memory leakage when creating decode context]
[95784]
[https://cgit.freedesktop.org/virglrenderer/commit/?id=747a293ff6055203e529f083896b823e22523fe7]
[[virglrenderer-devel] 20170210 [ANNOUNCE] virglrenderer 0.6.0]
[GLSA-201707-06]
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
[DSA-3772]
[[oss-security] 20170122 CVE Request: libXpm < 3.5.12 heap overflow]
[[oss-security] 20170125 Re: CVE Request: libXpm < 3.5.12 heap overflow]
[95785]
[RHSA-2017:1865]
[https://cgit.freedesktop.org/xorg/lib/libXpm/commit/?id=d1167418f0fd02a27f617ec5afd6db053afbe185]
[[xorg] 20161215 [ANNOUNCE] libXpm 3.5.12]
[GLSA-201701-72]
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
[openSUSE-SU-2017:0336]
[RHSA-2016:2079]
[RHSA-2016:2658]
[DSA-3774]
[[oss-security] 20170125 Re: CVE MLIST:[oss-security] 20170123 CVE request: lcms2 heap OOB read parsing crafted ICC profile]
[[oss-security] 20170125 Re: CVE request: lcms2 heap OOB read parsing crafted ICC profile]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[95808]
[1039596]
[RHSA-2017:2999]
[RHSA-2017:3046]
[RHSA-2017:3264]
[RHSA-2017:3267]
[RHSA-2017:3268]
[RHSA-2017:3453]
[https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2]
[https://security.netapp.com/advisory/ntap-20171019-0001/]
[USN-3770-1]
[USN-3770-2]
Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.
[http://libgd.github.io/release-2.2.4.html]
[DSA-3777]
[[oss-security] 20170126 CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[[oss-security] 20170128 Re: CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[95869]
[RHSA-2019:2519]
[https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35]
The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
[http://libgd.github.io/release-2.2.4.html]
[DSA-3777]
[[oss-security] 20170126 CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[[oss-security] 20170128 Re: CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[95869]
[1037659]
[RHSA-2017:3221]
[RHSA-2018:1296]
[https://github.com/libgd/libgd/commit/fe9ed49dafa993e3af96b6a5a589efeea9bfb36f]
[https://www.tenable.com/security/tns-2017-04]
Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
[http://libgd.github.io/release-2.2.4.html]
[DSA-3777]
[[oss-security] 20170126 CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[[oss-security] 20170128 Re: CVE Requests: libgd: potential unsigned onderflow, denial-of-service in gdImageCreateFromGd2Ctx and signed overflow in gd_io.c]
[95869]
[1037659]
[RHSA-2017:3221]
[RHSA-2018:1296]
[https://github.com/libgd/libgd/commit/69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6]
[https://github.com/libgd/libgd/issues/354]
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
[[oss-security] 20170128 Re: wavpack: multiple out of bounds memory reads]
[95883]
[https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc]
[https://sourceforge.net/p/wavpack/mailman/message/35557889/]
[USN-3568-1]
Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.
<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85926]
[1035509]
[http://www.zerodayinitiative.com/advisories/ZDI-16-225/]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
[[oss-security] 20170128 Re: wavpack: multiple out of bounds memory reads]
[95883]
[https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc]
[https://sourceforge.net/p/wavpack/mailman/message/35561921/]
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
[[oss-security] 20170128 Re: wavpack: multiple out of bounds memory reads]
[95883]
[https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc]
[https://sourceforge.net/p/wavpack/mailman/message/35561939/]
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
[[oss-security] 20170128 Re: wavpack: multiple out of bounds memory reads]
[95883]
[https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc]
[https://sourceforge.net/p/wavpack/mailman/message/35561951/]
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
[DSA-3778]
[[oss-security] 20170124 CVE request: rubygem minitar: directory traversal vulnerability]
[[oss-security] 20170129 Re: CVE request: rubygem minitar: directory traversal vulnerability]
[95874]
[https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4]
[https://github.com/halostatue/minitar/issues/16]
[https://puppet.com/security/cve/cve-2016-10173]
[GLSA-201702-32]
The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.
[http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability]
[http://seclists.org/fulldisclosure/2016/Dec/72]
[95867]
[https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt]
[40949]
[41719]
The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.
[http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability]
[http://seclists.org/fulldisclosure/2016/Dec/72]
[95867]
[https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt]
[40949]
The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.
[http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability]
[http://seclists.org/fulldisclosure/2016/Dec/72]
[95867]
[https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt]
[40949]
An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin and root with the password 1234.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. HELODBG on port 39889 (UDP) launches the "/sbin/telnetd -l /bin/sh" command.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[1035509]
[http://www.zerodayinitiative.com/advisories/ZDI-16-228/]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.
[95877]
[https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html]
The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript.
[[oss-security] 20170129 Requesting CVE for calibre file disclosure]
[[oss-security] 20170131 Re: Requesting CVE for calibre file disclosure]
[95909]
[https://bugs.launchpad.net/calibre/+bug/1651728]
[https://github.com/kovidgoyal/calibre/commit/3a89718664cb8c]
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfer connection to expire.
[DSA-3853]
[[oss-security] 20170130 CVE Request - Remote DoS vulnerabilities in BitlBee]
[[oss-security] 20170131 Re: CVE Request - Remote DoS vulnerabilities in BitlBee]
[95935]
[https://bugs.bitlbee.org/ticket/1281]
BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a contact that is not in the contact list.
[DSA-3853]
[[oss-security] 20170130 CVE Request - Remote DoS vulnerabilities in BitlBee]
[[oss-security] 20170131 Re: CVE Request - Remote DoS vulnerabilities in BitlBee]
[95931]
[https://bugs.bitlbee.org/ticket/1282]
[https://github.com/bitlbee/bitlbee/commit/701ab8129ba9ea64f569daedca9a8603abad740f]
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
[http://blogs.adobe.com/psirt/?p=1330]
[openSUSE-SU-2016:0987]
[SUSE-SU-2016:0990]
[openSUSE-SU-2016:0997]
[openSUSE-SU-2016:1157]
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85856]
[1035491]
[MS16-050]
[https://helpx.adobe.com/security/products/flash-player/apsa16-01.html]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
[GLSA-201606-08]
[https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html]
Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.
[[oss-security] 20170201 CVE Request: ffmpeg remote exploitaion results code execution]
[[oss-security] 20170202 Re: CVE Request: ffmpeg remote exploitaion results code execution]
[95986]
[https://ffmpeg.org/security.html]
[https://github.com/FFmpeg/FFmpeg/commit/2a05c8f813de6f2278827734bf8102291e7484aa]
[[debian-lts-announce] 20181220 [SECURITY] [DLA 1611-1] libav security update]
[https://trac.ffmpeg.org/ticket/5992]
Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.
[[oss-security] 20170201 CVE Request: ffmpeg remote exploitaion results code execution]
[[oss-security] 20170202 Re: CVE Request: ffmpeg remote exploitaion results code execution]
[95989]
[https://ffmpeg.org/security.html]
[https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8b3ee7]
[[debian-lts-announce] 20181220 [SECURITY] [DLA 1611-1] libav security update]
Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size.
[[oss-security] 20170201 CVE Request: ffmpeg remote exploitaion results code execution]
[[oss-security] 20170202 Re: CVE Request: ffmpeg remote exploitaion results code execution]
[95991]
[https://ffmpeg.org/security.html]
[https://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156]
The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
[[oss-security] 20170131 CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r]
[[oss-security] 20170202 Re: CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r]
[https://github.com/dejan/espeak-ruby/issues/7]
The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
[[oss-security] 20170131 CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r]
[[oss-security] 20170202 Re: CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r]
[https://github.com/spejman/festivaltts4r/issues/1]
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.
[DSA-3789]
[[oss-security] 20170131 Bugs fixed in libevent 2.1.6]
[[oss-security] 20170202 Re: Bugs fixed in libevent 2.1.6]
[96014]
[1038320]
[RHSA-2017:1104]
[RHSA-2017:1106]
[RHSA-2017:1201]
[https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog]
[https://github.com/libevent/libevent/commit/96f64a022014a208105ead6c8a7066018449d86d]
[https://github.com/libevent/libevent/issues/317]
[GLSA-201705-01]
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
[DSA-3789]
[[oss-security] 20170131 Bugs fixed in libevent 2.1.6]
[[oss-security] 20170202 Re: Bugs fixed in libevent 2.1.6]
[96014]
[1038320]
[RHSA-2017:1104]
[RHSA-2017:1106]
[RHSA-2017:1201]
[https://bugzilla.mozilla.org/show_bug.cgi?id=1343453]
[https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog]
[https://github.com/libevent/libevent/commit/329acc18a0768c21ba22522f01a5c7f46cacc4d5]
[https://github.com/libevent/libevent/issues/318]
[GLSA-201705-01]
[https://www.mozilla.org/security/advisories/mfsa2017-10/]
[https://www.mozilla.org/security/advisories/mfsa2017-11/]
[https://www.mozilla.org/security/advisories/mfsa2017-12/]
[https://www.mozilla.org/security/advisories/mfsa2017-13/]
The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
[DSA-3789]
[[oss-security] 20170131 Bugs fixed in libevent 2.1.6]
[[oss-security] 20170202 Re: Bugs fixed in libevent 2.1.6]
[96014]
[1038320]
[RHSA-2017:1104]
[RHSA-2017:1106]
[RHSA-2017:1201]
[https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog]
[https://github.com/libevent/libevent/commit/ec65c42052d95d2c23d1d837136d1cf1d9ecef9e]
[https://github.com/libevent/libevent/issues/332]
[GLSA-201705-01]
The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted audio file.
[DSA-3820]
[[oss-security] 20170201 Multiple memory access issues in gstreamer]
[[oss-security] 20170202 Re: Multiple memory access issues in gstreamer]
[96001]
[RHSA-2017:2060]
[https://bugzilla.gnome.org/show_bug.cgi?id=775450]
[https://gstreamer.freedesktop.org/releases/1.10/#1.10.3]
[GLSA-201705-10]
The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted tag value.
[DSA-3820]
[[oss-security] 20170201 Multiple memory access issues in gstreamer]
[[oss-security] 20170202 Re: Multiple memory access issues in gstreamer]
[96001]
[RHSA-2017:2060]
[https://bugzilla.gnome.org/show_bug.cgi?id=775451]
[https://gstreamer.freedesktop.org/releases/1.10/#1.10.3]
[GLSA-201705-10]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32c231164b762dddefa13af5a0101032c70b50ef]
[http://source.android.com/security/bulletin/2017-03-01.html]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14]
[101783]
[1037965]
[1037968]
[RHSA-2017:1842]
[RHSA-2017:2077]
[RHSA-2017:2437]
[RHSA-2017:2444]
[https://github.com/torvalds/linux/commit/32c231164b762dddefa13af5a0101032c70b50ef]
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[97122]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[97116]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to index.php.
[[oss-security] 20170204 Re: [FOXMOLE SA 2016-07-05] ZoneMinder - Multiple Issues]
[97114]
[https://www.foxmole.com/advisories/foxmole-2016-07-05.txt]
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.
[openSUSE-SU-2017:0444]
[RHSA-2017:0630]
[[oss-security] 20170202 CVE request tigervnc: vnc server can crash when TLS handshake terminates early]
[[oss-security] 20170204 Re: CVE request tigervnc: vnc server can crash when TLS handshake terminates early]
[96012]
[RHSA-2017:2000]
[https://bugzilla.suse.com/show_bug.cgi?id=1023012]
[https://github.com/TigerVNC/tigervnc/commit/8aa4bc53206c2430bbf0c8f4b642f59a379ee649]
[GLSA-201801-13]
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a4b77cd47bb837b8557595ec7425f281f2ca1fe]
[20161115 OS-S 2016-22 - Local DoS: Linux Kernel EXT4 Memory Corruption / SLAB-Out-of-Bounds Read]
[[oss-security] 20170204 Re: Local DoS: Linux Kernel EXT4 Memory Corruption / SLAB-Out-of-Bounds Read]
[94354]
[RHSA-2017:1297]
[RHSA-2017:1298]
[RHSA-2017:1308]
[https://bugzilla.redhat.com/show_bug.cgi?id=1395190]
[https://github.com/torvalds/linux/commit/3a4b77cd47bb837b8557595ec7425f281f2ca1fe]
[[debian-lts-announce] 20171210 [SECURITY] [DLA 1200-1] linux security update]
[USN-3754-1]
The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.
[97327]
[https://github.com/libarchive/libarchive/issues/842]
[[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update]
[USN-3736-1]
[DSA-4360]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.
[98077]
[https://github.com/VirusTotal/yara/commit/3119b232c9c453c98d8fa8b6ae4e37ba18117cd4]
[https://github.com/VirusTotal/yara/issues/576]
libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.
[98078]
[https://github.com/VirusTotal/yara/commit/890c3f850293176c0e996a602ffa88b315f4e98f]
[https://github.com/VirusTotal/yara/issues/575]
Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack," a similar issue to CVE-2016-0270. NOTE: this issue may be due to the use of a third-party Cavium product.
[96172]
[https://github.com/nonce-disrespect/nonce-disrespect]
[https://support.radware.com/app/answers/answer_view/a_id/18456]
A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270.
[96163]
[https://github.com/nonce-disrespect/nonce-disrespect]
[https://www.a10networks.com/blog/cve-2016-0270-gcm-nonce-vulnerability]
Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
[[oss-security] 20170208 Re: CVE request virglrenderer: host memory leak issue in virgl_resource_attach_backing]
[96181]
[https://cgit.freedesktop.org/virglrenderer/commit/?id=40b0e7813325b08077b6f541b3989edb2d86d837]
[[virglrenderer-devel] 20170210 [ANNOUNCE] virglrenderer 0.6.0]
[GLSA-201707-06]
An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
[https://github.com/Fastspot/bigtree-form-builder/commit/06fde0cc67ff121b212715031e12574f50970fcd]
An issue was discovered in IT ITems DataBase (ITDB) through 1.23. The vulnerability exists due to insufficient filtration of user-supplied data in the "value" HTTP POST parameter passed to the "itdb-1.23/js/DataTables-1.8.2/examples/examples_support/editable_ajax.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
[https://github.com/sivann/itdb/issues/56]
The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.
[http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb]
[https://bugs.ghostscript.com/show_bug.cgi?id=697456]
The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
[http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d621292fb2c8157d9899dcd83fd04dd250e30fe4]
[https://bugs.ghostscript.com/show_bug.cgi?id=697444]
The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
[DSA-3838]
[http://www.ghostscript.com/cgi-bin/findgit.cgi?4bef1a1d32e29b68855616020dbff574b9cda08f]
[https://bugs.ghostscript.com/show_bug.cgi?id=697453]
[GLSA-201708-06]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.
[DSA-3838]
[http://www.ghostscript.com/cgi-bin/findgit.cgi?daf85701dab05f17e924a48a81edc9195b4a04e8]
[https://bugs.ghostscript.com/show_bug.cgi?id=697450]
[GLSA-201708-06]
The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document.
[https://bugs.ghostscript.com/show_bug.cgi?id=697400]
[GLSA-201706-08]
runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (segmentation violation and application crash) via crafted JavaScript code that triggers a "type confusion" in the JSON.stringify function.
[http://trac.webkit.org/changeset/208123]
[https://bugs.webkit.org/show_bug.cgi?id=164123]
An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
[https://github.com/bigtreecms/BigTree-CMS/blob/master/README.md]
[https://github.com/bigtreecms/BigTree-CMS/commit/59ebef5978f80e2fdc7b4db4a28b668c5a39fbc3]
An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
[https://ics-cert.us-cert.gov/advisories/ICSA-16-343-02]
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.
[[oss-security] 20161005 Re: CVE request: sunxi-debug (root privilege escalation in Allwinner kernel)]
[[oss-security] 20170215 Re: CVE request: sunxi-debug (root privilege escalation in Allwinner kernel)]
[93442]
[https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/]
[https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390]
[https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoor]
JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (bitfield out-of-bounds read and application crash) via crafted JavaScript code that is mishandled in the operatorString function, related to assembler/MacroAssemblerARM64.h, assembler/MacroAssemblerX86Common.h, and wasm/WasmB3IRGenerator.cpp.
[https://bugs.webkit.org/show_bug.cgi?id=165091]
[https://trac.webkit.org/changeset/209295]
Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service (CPU consumption) via a flood of ICMPv4 Port Unreachable packets.
[97105]
[http://www.zyxel.com/support/announcement_blacknurse_attack.shtml]
[https://cxsecurity.com/issue/WLB-2017020177]
The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
[http://openwall.com/lists/oss-security/2017/03/01/10]
[96525]
[https://sourceware.org/bugzilla/show_bug.cgi?id=19519]
udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191]
[http://securityadvisories.paloaltonetworks.com/Home/Detail/88]
[http://source.android.com/security/bulletin/2017-04-01.html]
[97397]
[1038201]
[https://github.com/torvalds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
A remote code execution vulnerability in the Qualcomm crypto driver. Product: Android. Versions: Android kernel. Android ID: A-34389927. References: QC-CR#1091408.
[97400]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
An elevation of privilege vulnerability in the Qualcomm sound codec driver. Product: Android. Versions: Android kernel. Android ID: A-33966912. References: QC-CR#1096799.
[97402]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-34386696. References: QC-CR#1024872.
[97339]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
An elevation of privilege vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-34389926. References: QC-CR#897452.
[97339]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
An information disclosure vulnerability in the Qualcomm IPA driver. Product: Android. Versions: Android kernel. Android ID: A-34390017. References: QC-CR#1069060.
[97365]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
A denial of service vulnerability in the Qualcomm WiFi driver. Product: Android. Versions: Android kernel. Android ID: A-34390620. References: QC-CR#1046409.
[97361]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
An information disclosure vulnerability in the Qualcomm USB driver. Product: Android. Versions: Android kernel. Android ID: A-33280689. References: QC-CR#1102418.
[97359]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF using the Linux kernel, the TA would not detect an issue and it would be treated as secure memory.
[97334]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue.
[97334]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel due to improper input validation an integer overflow vulnerability leading to a buffer overflow could potentially occur and a buffer over-read vulnerability could potentially occur.
[97334]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
A time-of-check time-of-use race condition could potentially exist in the secure file system in all Android releases from CAF using the Linux kernel.
[98555]
[1038201]
[https://source.android.com/security/bulletin/2017-04-01]
TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.
[DSA-3803]
[[oss-security] 20170305 TeX Live: CVE-2016-10243: whitelists a insecure binary/utility to be run as external program]
[96593]
[FEDORA-2017-b72cafa5b4]
[FEDORA-2017-a8add6c46c]
[https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/]
[GLSA-201709-07]
[https://www.tug.org/svn/texlive?view=revision&revision=42605]
The parse_charstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/ChangeLog?h=VER-2-7]
[DSA-3839]
[97405]
[1038090]
[1038201]
[https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36]
[GLSA-201706-14]
[https://source.android.com/security/bulletin/2017-04-01]
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
[openSUSE-SU-2019:1486]
[108476]
[http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12]
[https://bugzilla.gnome.org/show_bug.cgi?id=762934]
[https://github.com/doxygen/doxygen/commit/1cc1adad2de03a0f013881b8960daf89aa155081]
[[debian-lts-announce] 20190531 [SECURITY] [DLA 1812-1] doxygen security update]
[USN-4002-1]
Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
[http://git.ghostscript.com/?p=mupdf.git;h=cfe8f35bca61056363368c343be36812abde0a06]
[[oss-security] 20170313 Re: mupdf: mujstest: global-buffer-overflow in main (jstest_main.c)]
[https://blogs.gentoo.org/ago/2016/09/24/mupdf-mujstest-global-buffer-overflow-in-main-jstest_main-c/]
Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
[http://git.ghostscript.com/?p=mupdf.git;h=446097f97b71ce20fa8d1e45e070f2e62676003e]
[[oss-security] 20170313 Re: mupdf: mujstest: global-buffer-overflow in my_getline (jstest_main.c)]
[97099]
[https://blogs.gentoo.org/ago/2016/09/24/mupdf-mujstest-global-buffer-overflow-in-my_getline-jstest_main-c/]
The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
[93797]
[RHSA-2017:1208]
[https://blogs.gentoo.org/ago/2016/10/20/jasper-null-pointer-dereference-in-jpc_tsfb_synthesize-jpc_tsfb-c/]
[https://github.com/mdadams/jasper/commit/2e82fa00466ae525339754bb3ab0a0474a31d4bd]
[USN-3693-1]
Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.
[DSA-3827]
[93838]
[RHSA-2017:1208]
[https://blogs.gentoo.org/ago/2016/10/23/jasper-heap-based-buffer-overflow-in-jpc_dec_tiledecode-jpc_dec-c/]
[https://github.com/mdadams/jasper/commit/988f8365f7d8ad8073b6786e433d34c553ecf568]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.
[https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887/]
[https://github.com/mdadams/jasper/commit/bdfe95a6e81ffb4b2fad31a76b57943695beed20]
[USN-3693-1]
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
[DSA-3827]
[97584]
[RHSA-2017:1208]
[https://blogs.gentoo.org/ago/2016/11/04/jasper-use-of-uninitialized-value-in-jpc_pi_nextcprl-jpc_t2cod-c/]
[https://github.com/mdadams/jasper/commit/1f0dfe5a42911b6880a1445f13f6d615ddb55387]
Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.
[http://git.imagemagick.org/repos/ImageMagick/commit/6790815c75bdea0357df5564345847856e995d6b]
[DSA-3808]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857426]
[https://github.com/Opendigitalradio/ODR-PadEnc/issues/2]
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
[https://github.com/erlang/otp/pull/1108]
[USN-3571-1]
The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.
[[oss-security] 20170322 Re: elfutils: memory allocation failure in allocate_elf (common.h)]
[https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-allocate_elf-common-h/]
[[elfutils-devel] 20161024 [PATCH] libelf: Always set ELF maxsize when reading an ELF file for sanity checks.]
[GLSA-201710-10]
[USN-3670-1]
The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.
[[oss-security] 20170322 Re: elfutils: memory allocation failure in __libelf_set_rawdata_wrlock (elf_getdata.c)]
[https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-__libelf_set_rawdata_wrlock-elf_getdata-c/]
[https://bugzilla.redhat.com/show_bug.cgi?id=1387584]
[[elfutils-devel] 20161021 [PATCH] libelf: Sanity check offset and size before trying to malloc and read data.]
[GLSA-201710-10]
[USN-3670-1]
The Symantec ProxySG 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10257.
[102451]
[1040138]
[https://www.symantec.com/security-center/network-protection-security-advisories/SA155]
The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10256.
[102447]
[1040138]
[https://www.symantec.com/security-center/network-protection-security-advisories/SA155]
Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code.
[103685]
[1040757]
[https://www.symantec.com/security-center/network-protection-security-advisories/SA162]
Symantec SSL Visibility (SSLV) 3.8.4FC, 3.9, 3.10 before 3.10.4.1, and 3.11 before 3.11.3.1 is susceptible to a denial-of-service vulnerability that impacts the SSL servers for intercepted SSL connections. A malicious SSL client can, under certain circumstances, temporarily exhaust the TCP connection pool of an SSL server.
[97525]
[https://bto.bluecoat.com/security-advisory/sa142]
[https://www.symantec.com/security-center/network-protection-security-advisories/SA142]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_read.c:351:22.
[DSA-3844]
[97115]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-divide-by-zero]
[https://github.com/vadz/libtiff/commit/438274f938e046d33cb0e1230b41da32ffe223e1]
[USN-3602-1]
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image, related to libtiff/tif_ojpeg.c:816:8.
[DSA-3844]
[97117]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-divide-by-zero]
[https://github.com/vadz/libtiff/commit/43bc256d8ae44b92d2734a3c5bc73957a4d7c1ec]
[GLSA-201709-27]
[USN-3602-1]
tools/tiffcp.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (integer underflow and heap-based buffer under-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 78490" and libtiff/tif_unix.c:115:23.
[97202]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/5397a417e61258c69209904e652a1f409ec3b9df]
[GLSA-201709-27]
[USN-3602-1]
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 512" and libtiff/tif_unix.c:340:2.
[DSA-3844]
[97201]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/1044b43637fa7f70fb19b93593777b78bd20da86]
[USN-3602-1]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 8" and libtiff/tif_read.c:523:22.
[DSA-3844]
[97200]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/9a72a69e035ee70ff5c41541c8c61cd97990d018]
tools/tiffcrop.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer over-read and buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "READ of size 1" and libtiff/tif_fax3.c:413:13.
[97199]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0ba6a]
LibTIFF 4.0.7 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted TIFF image, related to "WRITE of size 2048" and libtiff/tif_next.c:64:9.
[97197]
[https://blogs.gentoo.org/ago/2017/01/01/libtiff-multiple-heap-based-buffer-overflow/]
[https://github.com/vadz/libtiff/commit/9657bbe3cdce4aaa90e07d50c1c70ae52da0ba6a]
Multiple stack buffer overflow vulnerabilities in Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary code or crash the web service via the (1) ateFunc, (2) ateGain, (3) ateTxCount, (4) ateChan, (5) ateRate, (6) ateMacID, (7) e2pTxPower1, (8) e2pTxPower2, (9) e2pTxPower3, (10) e2pTxPower4, (11) e2pTxPower5, (12) e2pTxPower6, (13) e2pTxPower7, (14) e2pTx2Power1, (15) e2pTx2Power2, (16) e2pTx2Power3, (17) e2pTx2Power4, (18) e2pTx2Power5, (19) e2pTx2Power6, (20) e2pTx2Power7, (21) ateTxFreqOffset, (22) ateMode, (23) ateBW, (24) ateAntenna, (25) e2pTxFreqOffset, (26) e2pTxPwDeltaB, (27) e2pTxPwDeltaG, (28) e2pTxPwDeltaMix, (29) e2pTxPwDeltaN, and (30) readE2P parameters of the /goform/formWlanMP endpoint.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-30202412. References: M-ALPS02897901.
[98145]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-34514954. References: QC-CR#1009111.
[98146]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32952839. References: QC-CR#1094105.
[98148]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33840490.
[98149]
[https://source.android.com/security/bulletin/2017-05-01]
[42601]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-28175767. References: M-ALPS02696445.
[98157]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-28175647. References: M-ALPS02696475.
[98158]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-33939045. References: M-ALPS03149189.
[98159]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32094986. References: QC-CR#2002052.
[98160]
[https://source.android.com/security/bulletin/2017-05-01]
[https://www.codeaurora.org/stack-overflow-wifi-driver-function-wlanhddchangestation-cve-2016-10283]
An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402303. References: QC-CR#2000664.
[98162]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33752702. References: QC-CR#1104899.
[98163]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-35400904. References: QC-CR#1090237.
[98165]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33784446. References: QC-CR#1112751.
[98167]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33863909. References: QC-CR#1109763.
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33899710. References: QC-CR#1116295.
[https://source.android.com/security/bulletin/2017-05-01]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1032, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
An elevation of privilege vulnerability in the Qualcomm shared memory driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33898330. References: QC-CR#1109782.
[98182]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-34030871. References: QC-CR#986837.
[98183]
[https://source.android.com/security/bulletin/2017-05-01]
A denial of service vulnerability in the Qualcomm Wi-Fi driver could enable a proximate attacker to cause a denial of service in the Wi-Fi subsystem. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34514463. References: QC-CR#1065466.
[98204]
[https://source.android.com/security/bulletin/2017-05-01]
An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33352393. References: QC-CR#1101943.
[98206]
[https://source.android.com/security/bulletin/2017-05-01]
An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33621829. References: QC-CR#1105481.
[https://source.android.com/security/bulletin/2017-05-01]
An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33781694. References: QC-CR#1109326.
[https://source.android.com/security/bulletin/2017-05-01]
[https://www.codeaurora.org/possible-kernel-information-leak-qpnp-flash-led-driver-debugfs-function-cve-2016-10295]
An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33845464. References: QC-CR#1109782.
[https://source.android.com/security/bulletin/2017-05-01]
In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
[98241]
[https://source.android.com/security/bulletin/2017-05-01]
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393252.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-32577244.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service (out-of-memory error and service instability) via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788.
[https://erpscan.io/advisories/erpscan-16-029-sap-netweaver-java-7-5-deserialization-untrusted-user-value-trustmanagementservlet/]
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
[http://blog.iancaling.com/post/153011925478]
Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
[http://blog.iancaling.com/post/153011925478]
[http://blog.iancaling.com/post/155395764003]
[97241]
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
[http://blog.iancaling.com/post/153011925478]
[97242]
Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
[http://blog.iancaling.com/post/145309944453]
[97243]
In the GUI of Ceragon FibeAir IP-10 (before 7.2.0) devices, a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.
[http://blog.iancaling.com/post/145973147383]
[91263]
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1017.
<a href="https://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85926]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service (resource consumption and process crash) by sending a crafted packet several times, aka SAP Security Note 2308778.
[91197]
[https://erpscan.io/advisories/erpscan-16-024-sap-sql-anywhere-mobilink-synchronization-server-buffer-overflow/]
Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted packet to the SAPSTARTSRV port, aka SAP Security Note 2295238.
[https://erpscan.io/advisories/erpscan-16-030-sap-netweaver-sapstartsrv-stack-based-buffer-overflow/]
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct CSRF attacks via certain /goform/* pages.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to read passwords via a direct request to the x.asp page.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the submit-url parameter to certain /goform/* pages.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout.
[https://www.riskbasedsecurity.com/research/RBS-2016-004.pdf]
The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
[97410]
[https://bugs.ghostscript.com/show_bug.cgi?id=697459]
[USN-3636-1]
A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption policy to a directory owned by a different user, potentially creating a denial of service.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=163ae1c6ad6299b19e22b4a35d5ab24a89791a98]
[http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.4]
[97404]
[https://github.com/torvalds/linux/commit/163ae1c6ad6299b19e22b4a35d5ab24a89791a98]
In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overflows. This affects certain cases involving execution of both AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.
[https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-1]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, and CVE-2016-1033.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.
[http://seclists.org/oss-sec/2016/q4/442]
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
[https://github.com/web2py/web2py/commit/944d8bd8f3c5cf8ae296fc03d149056c65358426]
[https://github.com/web2py/web2py/issues/1585#issuecomment-284317919]
[USN-4030-1]
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.
[http://seclists.org/oss-sec/2016/q1/236]
[https://www.synology.com/en-us/releaseNote/PhotoStation]
Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synophoto_dsm_user --copy-no-ea" command.
[http://seclists.org/oss-sec/2016/q1/236]
[https://www.synology.com/en-us/releaseNote/PhotoStation]
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.
[DSA-3879]
[97641]
[https://savannah.gnu.org/support/index.php?109133]
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS.
[DSA-3879]
[92921]
[https://savannah.gnu.org/support/index.php?109131]
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.
[DSA-3879]
[92921]
[https://savannah.gnu.org/support/index.php?109132]
LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.
[http://www.libreoffice.org/about-us/security/advisories/cve-2016-10327/]
[97668]
[https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=313]
[https://github.com/LibreOffice/core/commit/7485fc2a1484f31631f62f97e5c64c0ae74c6416]
[GLSA-201706-28]
FreeType 2 before 2016-12-16 has an out-of-bounds write caused by a heap-based buffer overflow related to the cff_parser_run function in cff/cffparse.c.
[http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=beecf80a6deecbaf5d264d4f864451bde4fe98b8]
[http://savannah.nongnu.org/bugs/?func=detailitem&item_id=49858]
[97677]
[https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=289]
[GLSA-201706-14]
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
[[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation]
[https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password]
[https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution]
[https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226]
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, and CVE-2016-1032.
[SUSE-SU-2016:1305]
[openSUSE-SU-2016:1306]
[RHSA-2016:0610]
[85932]
[1035509]
[https://helpx.adobe.com/security/products/flash-player/apsb16-10.html]
Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.
[[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation]
[https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-03-Read-Write-Arbitrary-Files]
[https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-04-Privilege-Escalation]
[https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226]
Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to read arbitrary files via a full pathname in the id parameter.
[https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-06-Local-File-Inclusion]
[https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226]
In all Android releases from CAF using the Linux kernel, stack protection was not enabled for secure applications.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, libtomcrypt was updated.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, some regions of memory were not protected during boot.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, some validation of secure applications was not being performed.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, there was an issue related to RPMB processing.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
[http://www.zerodayinitiative.com/advisories/ZDI-16-235]
[https://helpx.adobe.com/security/products/creative-cloud/apsb16-11.html]
In all Android releases from CAF using the Linux kernel, an integer underflow leading to buffer overflow vulnerability exists in a syscall handler.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a syscall handler.
[98874]
[1038623]
[https://source.android.com/security/bulletin/2017-06-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, sSL handshake failure with ClientHello rejection results in memory leak.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially possible in LTE.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.
[https://github.com/phusion/passenger/blob/stable-5.1/CHANGELOG]
[https://github.com/phusion/passenger/commit/e5b4b0824d6b648525b4bf63d9fa37e5beeae441]
In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow vulnerability exists in the hypervisor.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a hypervisor function is not properly validated.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
[100347]
[https://github.com/libarchive/libarchive/issues/834]
[[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update]
[GLSA-201710-19]
[USN-3736-1]
[DSA-4360]
Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors.
[1035557]
[https://helpx.adobe.com/security/products/robohelp-server/apsb16-12.html]
The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
[https://github.com/libarchive/libarchive/issues/835]
[[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update]
[GLSA-201710-19]
[USN-3736-1]
[DSA-4360]
Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard filesystem operations.
[https://github.com/telegramdesktop/tdesktop/issues/2666]
[https://github.com/telegramdesktop/tdesktop/pull/3842/commits/388703b9ca1912a5438e37f9dd54c35805f2c594]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[1035671]
[https://helpx.adobe.com/security/products/analytics/apsb16-13.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.
[99154]
[https://www.elastic.co/community/security]
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.
[https://www.elastic.co/community/security]
With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authenticated user could make requests to those services regardless of their own permissions.
[https://www.elastic.co/community/security]
Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to an arbitrary website.
[https://www.elastic.co/community/security]
Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.
[https://www.elastic.co/community/security]
In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding bypass, %252f instead of /.
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341]
Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the /login URI.
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341]
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).
[https://bugs.debian.org/862098]
[https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648]
[https://unix.stackexchange.com/questions/333539/lxterminal-in-the-netstat-output/333578]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.
[98495]
[https://alephsecurity.com/vulns/aleph-2017022]
[https://forums.oneplus.net/threads/ota-and-imei-over-http.453992/]
The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF file.
[http://bugzilla.maptools.org/show_bug.cgi?id=2535]
[http://bugzilla.maptools.org/show_bug.cgi?id=2612]
[USN-3602-1]
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and using the NewNTPServer feature.
[https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/]
[https://ghostbin.com/paste/q2vq2]
[https://isc.sans.edu/forums/diary/TR069+NewNTPServer+Exploits+What+we+know+so+far/21763/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10214. Reason: This candidate is a reservation duplicate of CVE-2016-10214. Notes: All CVE users should reference CVE-2016-10214 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink, as demonstrated by creating a perltidy.ERR symlink that the victim cannot delete.
[https://bugs.debian.org/862667]
Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in queue/queuepush.c.
[https://github.com/fbb-git/yodl/commit/fd85f8c94182558ff1480d06a236d6fb927979a3]
[https://github.com/fbb-git/yodl/issues/1]
Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions.
[DSA-3943]
[https://bugs.debian.org/863445]
[https://dev.gajim.org/gajim/gajim/commit/cb65cfc5aed9efe05208ebbb7fb2d41fcf7253cc]
[https://dev.gajim.org/gajim/gajim/issues/8378]
[https://mail.jabber.org/pipermail/standards/2016-August/031335.html]
[GLSA-201707-14]
In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in `lib/flow.c` in the function `miniflow_extract`, permitting remote bypass of the access control list enforced by the switch.
[https://mail.openvswitch.org/pipermail/ovs-dev/2016-July/319503.html]
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.
[http://code610.blogspot.com/2016/09/sql-injection-in-latest-e107-cms.html]
The VirtueMart com_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemart_paymentmethod_id or virtuemart_shipmentmethod_id parameter to administrator/index.php.
[http://code610.blogspot.com/2016/08/testing-sql-injections-in-comvirtuemart.html]
[98753]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-292]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send unprotected MeasurementReports revealing UE location.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send unprotected MeasurementReports revealing UE location.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, access control to the I2C bus is not sufficient.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, there is a TOCTOU race condition in Secure UI.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a WLAN driver ioctl.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, a use-after-free vulnerability exists in IMS RCS.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, an array index out of bounds vulnerability exists in LPP.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a handover scenario.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, a configuration vulnerability exists when loading a 3rd-party QTEE application.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition.
[99465]
[https://source.android.com/security/bulletin/2017-07-01]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-290]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In all Qualcomm products with Android releases from CAF using the Linux kernel, when downloading a file, an excessive amount of memory may be consumed.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity.
[99467]
[https://source.android.com/security/bulletin/2017-07-01]
In all Qualcomm products with Android releases from CAF using the Linux kernel, a driver can potentially leak kernel memory.
[103671]
[https://source.android.com/security/bulletin/2017-07-01]
[https://source.android.com/security/bulletin/2018-04-01]
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with large size values, integer arithmetic overflows, and allocated buffer size will be less than intended buffer size. The following buffer operations will overflow the allocated buffer.
[103292]
[https://source.android.com/security/bulletin/2018-03-01]
In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.
[https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01]
[https://secuniaresearch.flexerasoftware.com/advisories/76368/]
[https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager]
[https://www.schneider-electric.com/en/download/document/SEVD-2018-046-01/]
[https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/]
[https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/]
The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote endpoint by repeatedly sending ISAKMP fragment packets in a particular order such that the worst-case computational complexity is realized in the algorithm utilized to determine if reassembly of the fragments can take place.
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c.diff?r1=1.5&r2=1.5.36.1]
[http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c?only_with_tag=MAIN]
[https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682]
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).
[http://git.php.net/?p=php-src.git;a=commit;h=b061fa909de77085d3822a89ab901b934d0362c4]
[http://openwall.com/lists/oss-security/2017/07/10/6]
[http://php.net/ChangeLog-5.php]
[http://php.net/ChangeLog-7.php]
[99552]
[https://bugs.php.net/bug.php?id=73192]
[https://security.netapp.com/advisory/ntap-20180112-0001/]
Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens (AuthTokens) used by the Trusted Execution Environment (TEE) are protected by a weak challenge. This allows adversaries to replay previously captured responses and use the TEE without authenticating. All apps using authentication-gated cryptography are vulnerable to this attack, which was confirmed on the LG Nexus 5X.
[https://homepages.staff.os3.nl/~delaat/rp/2015-2016/p30/report.pdf]
Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via a specially crafted URL.
[https://sendio.com/support/software-release-history/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary file by visiting get_course_icon.php?id= after the traversal attack.
[https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2]
[https://www.htbridge.com/advisory/HTB23297]
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known (or a non-root default account exists within an ISP's deployment of these devices).
[https://forum.openwrt.org/viewtopic.php?id=62266]
[43105]
Avira Antivirus engine versions before 8.3.36.60 allow remote code execution as NT AUTHORITY\SYSTEM via a section header with a very large relative virtual address in a PE file, causing an integer overflow and heap-based buffer underflow.
[84841]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=765]
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
[https://chromereleases.googleblog.com/2016/05/stable-channel-update_25.html]
[https://crbug.com/602046]
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-INF/resources/init.jsp.
[https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-70/-/asset_publisher/cjE0ourZXJZE/content/cst-7017-multiple-xss-vulnerabilities]
[https://github.com/liferay/liferay-portal/commit/333f65bae9106182d12e02d249d4f95e16e93fa2]
Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.
[ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-600L/DIR-600L_REVA_FIRMWARE_PATCH_NOTES_1.17.B01_EN_WW.PDF]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 835, while printing debug message of a pointer in wlan_qmi_err_cb, the real kernel address will be printed regardless of the kptr_restrict system settings.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, an integer overflow leading to buffer overflow can occur during a VT call.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, and SD 835, TOCTOU vulnerability may occur while composing the RPMB request using HLOS controlled buffers.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1042, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-288]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, buffer overflow vulnerability in RTP during Volte call.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, RTP daemon crashes and terminates VT call when UE receives RTCP unknown APP packet report which caused the parser to miss an end of RTCP packet length and go on forever looking for it, even going beyond the limits of the RTCP Packet length.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, an integer overflow leading to buffer overflow can potentially occur in a memory API function.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, when a hash is passed with zero datalength, the code returns an error, even though zero data length is valid.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, dereference of an invalid input parameter could cause a denial of service.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 820, UE crash is seen due to IPCMem exhaustion, when UDP data is pumped to UE's ULP (UserPlane Location protocol) UDP port 7275.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SDX20, in QTEE, a TOCTOU vulnerability exists due to improper access control.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, and SD 835, HLOS can enable PMIC debug through TCSR_QPDI_DISABLE_CFG due to improper access control.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, and SDX20, when initializing scheduler object service request, an out of bounds access could occur due to uninitialized object number.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1044, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-287]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, while playing back a .flv clip which doesn't have an inbuilt seek table, a dynamic index table access is out of bounds and leads to crash.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, key material is not always cleared properly.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, MDM9206, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, improper access control in system call leads to unauthorized access.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, when a Trusted Application has opened the SPI interface to a particular device, it is possible for another Trusted Application to read the data on this open interface due to non-exclusive access of the SPI bus.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, SD 820A, SD 835, SD 845, and SD 850, upgrading LibPNG from 1.6.12 to 1.6.21 fixes multiple issues with different CWEs.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, if GPT listener response is passed a large buffer offset, a buffer overflow occurs.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, a buffer overflow can occur in SafeSwitch.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper boundary check in RLC AM module leads to denial of service by reaching assertion.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, HMAC verification in counter file uses an insecure memcmp which may assist a timing attack.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SDX20, three image types are loaded in the same manner without distinguishing them.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Integer overflow in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
[90516]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-286]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, when executing a TA which has been granted privileges to the CPVC MINK class it is possible for the TA to access methods exposed by the CPVC interface.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, and SD 850, TZ applications are not properly validated.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 820, and SD 820A, TOCTOU vulnerabilities may occur while sanitizing userspace values passed to tQSEE system call.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, TOCTOU vulnerability during SSD image decryption may cause memory corruption.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 820 and SD 820A, the input to RPMB write response function is a buffer from HLOS that needs to be authenticated (using HMAC) and then processed. However, some of the processing occurs before the buffer is authenticated. The function will return various types of errors depending on the values of the `response` and `result` fields of the buffer before verifying the HMAC tag.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9625, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, in some QTEE syscall handlers, a TOCTOU vulnerability exists.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA4531, QCA9980, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, improper input validation infuse read request leads to memory corruption.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, while logging debug statements or ftrace events from rmnet_data, the socket buffer function uses normal format specifiers which may result in information exposure.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA4531, QCA9980, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, information exposure vulnerability when logging debug statement due to %p usage.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, there is a TOCTOU vulnerability in the input validation for bulletin_board_read syscall. A pointer dereference is being validated without promising the pointer hasn't been changed by the HLOS program.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1062, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-291]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, and SD 650/52, there is improper access control to a bus.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, improper offset validation leads to buffer overflow in video parser.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, SDM630, MSM8976, MSM8937, SDM845, MSM8976, and MSM8952, when running module or kernel code with improper access control allowing writing to arbitrary regions of memory, the user may utilize this vector to alter module executable code.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, packet replay may be possible.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 820, SD 820A, and SD 835, SMMU Access Control Policy was updated to block HLOS from accessing BLSP and BAM resources.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, input is not properly validated in a QTEE API function.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 820, SD 820A, and SD 835, incorrect configuration of the OCIMEM MPU may provide NonSecure Software access to OCIMEM memory used by TZ.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, and SDX20, secure UI crash due to uninitialized link list entry in dynamic font module.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, a simultaneous command post for addSA or updateSA on same SA leads to memory corruption. APIs addSA and updateSA APIs access the global variable ipsec_sa_list[] outside of mutex protection.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, and SD 835, in a GNSS API function, a NULL pointer dereference can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-293]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Mobile, and Snapdragon Wear FSM9055, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, potential stack-based buffer overflow exist in thermal service leading to root compromise.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, privilege escalation may occur due to inherently insecure treatment of local files.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, and SD 835, memory protection assertion happens after invoking TA termination out of order.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, and SD 625, in a QTEE API function, an array out-of-bounds index can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper initialization of ike_sa_handle_ptr in IPSEC leads to system denial of service.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, if radish is executed with an interface name set to an invalid interface name, an arbitrary command of 15 characters or less may be executed as a system call.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, app is requesting more permissions than required.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, and Snapdragon_High_Med_2016, the 'proper' solution for this will be to ensure that any users of qsee_log in the bootchain (before Linux boots) unallocate their buffers and clear the qsee_log pointer. Until support for that is implemented in TZ and the bootloader, enable tz_log to avoid potential scribbling. This solution will prevent the linux kernel memory corruption.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 800, SD 810, and SD 820, during a call, memory exhaustion can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-294]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 835, SD 845, and SD 850, vendor specific opcodes may not have any packet length validation leading to buffer over-reads.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9650, SD 650/52, SD 808, SD 810, SD 820, and SDX20, lack of proper bounds checking may lead to a buffer overread.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, the Access Control policy for HLOS allows access to Slimbus, GPU, GIC resources.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6174A, QCA6574AU, QCA9377, SD 210/SD 212/SD 205, SD 425, SD 600, SD 650/52, SD 808, SD 810, SD 820, and SDX20, lack of input validation for HCI H4 UART packet ID cause system denial of service.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, during SSL handshake, if RNG function (crypto API) returns error, SSL uses hard-coded random value.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 820, and SD 820A, function ce_pkcs1_pss_padding_verify_auto_recover_saltlen assumes that the size of the encoded message is equal to the size of the RSA modulus. This assumption is true for most RSA keys, but it fails when modulus_bitlen % 8 == 1.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, incorrect implementation of RSA padding functions in CORE.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-295]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, an unsigned RTIC health report susceptible to tampering by malware executing in the context of the HLOS may be requested.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, address and size passed to SCM command 'TZ_INFO_GET_SECURE_STATE_LEGACY_ID' from HLOS Kernel were not being checked, so access outside DDR would occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, in a supplementary services function, a buffer overflow can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, if the buffer length passed to the RIL interface is too large, the buffer size calculation may overflow, resulting in an undersize allocation for the buffer, and subsequently buffer overwrite.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 820, lack input validation may lead to a integer overflow that could potentially lead to a buffer overflow.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, missing array index checks on app index in function qcril_uim_clear_encrypted_pin results in accessing addresses outside the bounds of the buffer when app index is too large.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 820, while processing smart card requests, a buffer overflow can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 617, incorrect size calculation in QCRIL SCWS processing have Integer overflow which will lead to a buffer overflow.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9607, MDM9615, MDM9635M, MDM9640, SD 210/SD 212/SD 205, SD 400, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 810, and SD 820, an arbitrary length value from an incoming message to QMI Proxy can lead to an out-of-bounds write in the stack variable message.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-296]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, possible memory corruption due to invalid integer overflow checks in exif parsing.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, if WLAN FW receives the WMI_STA_SMPS_PARAM_CMDID ioctl in not-associated state, when the virtual channel handle is not assigned, the code doesn't check for NULL virtual channel handle, so an assert occurs.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, while processing downlink information, an assert can be reached.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, improper input validation while processing SCM Command can lead to unauthorized memory access.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, if a RPMB listener is registered with a very small buffer size, the calculation of the maximum transfer size for read and write operations may underflow, resulting in buffer overflow.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, and SDX20, lack of proper bounds checking may lead to a buffer overflow.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 820A, PD failure reason string from user PD is used directly in root PD, so if the buffer parameter is non-NULL terminated in Diag F3 APIs, a buffer overread occurs.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, in a QuRT API function, an untrusted pointer dereference can occur.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, lack of address argument validation in qsee_get_tz_app_name() may lead to an untrusted pointer dereference.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-297]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, if a negative value is passed as argument "max" to qurt_qdi_state_local_new_handle_from_obj, an buffer overflow occurs, due to typecasting the signed integer to unsigned.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, an integer overflow leading to buffer overflow can occur in a QuRT API function.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper ciphersuite validation leads SecSSL accept an unadvertised ciphersuite.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, NPA routines on the rootPD that handle resource requests remoted over QDI may not validate pointers passed from user space which may result in guest OS memory corruption.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9625, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer overflow may lead to buffer overflows in IPC router Root-PD driver.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, made changes to map the scan type value to an index value that is in range.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 210/SD 212/SD 205, SD 410/12, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, A NULL pointer dereference can occur during an SSL handshake.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper CFG allocation can cause heap leak.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, MDM9645, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, stopping of the DTR prematurely causes micro kernel to be stuck. This can be triggered with a timing change injectable in RACH procedure.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, memory leak may occur in the IPSecurity module when repeating IKE-Rekey.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-298]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none.
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9635M, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 835, improper input validation can occur while parsing an image.
[103671]
[https://source.android.com/security/bulletin/2018-04-01]
While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identity in Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835 and SDA660.
[105838]
[https://source.android.com/security/bulletin/2018-11-01#qualcomm-components]
IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803.
[http://www.ibm.com/support/docview.wss?uid=swg22006439]
[https://exchange.xforce.ibmcloud.com/vulnerabilities/113803]
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
[DSA-4013]
[100564]
[https://github.com/uclouvain/openjpeg/commit/397f62c0a838e15d667ef50e27d5d011d2c79c04]
[https://github.com/uclouvain/openjpeg/issues/835]
[GLSA-201710-26]
[42600]
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
[https://github.com/uclouvain/openjpeg/issues/776]
[https://github.com/uclouvain/openjpeg/issues/784]
[https://github.com/uclouvain/openjpeg/issues/785]
[https://github.com/uclouvain/openjpeg/issues/792]
[GLSA-201710-26]
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
[100573]
[https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad62b33d2dc1ba2bb1eeaafe7b]
[https://github.com/uclouvain/openjpeg/issues/731]
[https://github.com/uclouvain/openjpeg/issues/732]
[https://github.com/uclouvain/openjpeg/issues/777]
[https://github.com/uclouvain/openjpeg/issues/778]
[https://github.com/uclouvain/openjpeg/issues/779]
[https://github.com/uclouvain/openjpeg/issues/780]
[GLSA-201710-26]
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
[100567]
[https://github.com/uclouvain/openjpeg/commit/da940424816e11d624362ce080bc026adffa26e8]
[https://github.com/uclouvain/openjpeg/issues/833]
[GLSA-201710-26]
Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php.
[https://github.com/JamesHeinrich/phpThumb/commit/162ae709162be3e6c4d942313a278ca5cbdb8e92]
SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.
[https://github.com/opencart/opencart/commit/b95044da6ac608e7239f7949ff21d3b65be68f82]
[https://github.com/opencart/opencart/issues/4114]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-299]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
[[debian-lts-announce] 20171105 [SECURITY] [DLA 1161-1] redis security update]
Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php.
[https://github.com/kohana/kohana/issues/107]
[https://github.com/kohana/kohana/releases/tag/v3.3.6]
[[debian-lts-announce] 20180114 [SECURITY] [DLA 1241-1] libkohana2-php security update]
[https://www.checkmarx.com/advisories/cross-site-scripting-xss-vulnerability-in-kohana/]
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.
[100904]
[https://hackerone.com/reports/168538]
MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are retrieved by the system when the LDAP configuration page is opened and are embedded directly into the HTML source code in cleartext.
[https://packetstormsecurity.com/files/139844/Multitech-RightFax-Faxfinder-Credential-Disclosure.html]
Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
[http://piwigo.org/releases/2.8.3]
[https://github.com/Piwigo/Piwigo/commit/9a93d1f44b06605af84520509e7a0e8b64ab0c05]
[https://github.com/Piwigo/Piwigo/issues/548]
url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
[http://piwigo.org/releases/2.8.3]
[https://github.com/Piwigo/Piwigo/commit/b3157cbfd859c914911b114d4edbba4654758b57]
[https://github.com/Piwigo/Piwigo/issues/547]
In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages.
[https://www.redmine.org/projects/redmine/wiki/Security_Advisories]
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
[http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger/]
[https://github.com/pallets/werkzeug/pull/1001]
[[debian-lts-announce] 20171124 [SECURITY] [DLA 1191-1] python-werkzeug security update]
networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).
[101572]
[https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50]
[https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES]
[https://www.reddit.com/r/redis/comments/5r8wxn/redis_327_is_out_important_security_fixes_inside/]
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
[https://gist.github.com/c0nrad/e92005446c480707a74a]
[https://github.com/websockets/ws/releases/tag/1.0.1]
[https://nodesecurity.io/advisories/67]
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
[https://github.com/feross/bittorrent-dht/issues/87]
[https://nodesecurity.io/advisories/68]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-300]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
[https://nodesecurity.io/advisories/52]
jshamcrest is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in to the emailAddress validator.
[https://nodesecurity.io/advisories/53]
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
[https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a]
[https://www.sourceclear.com/blog/Rails_admin-Vulnerability-Disclosure/]
[https://www.sourceclear.com/registry/security/cross-site-request-forgery-csrf-/ruby/sid-3173]
MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
[https://github.com/mcollina/mosca/issues/393]
[https://github.com/mqttjs/mqtt-packet/pull/8]
[https://nodesecurity.io/advisories/75]
i18n-node-angular is a module used to interact between i18n and angular without using additional resources. A REST API endpoint that is used for development in i18n-node-angular before 1.4.0 was not disabled in production environments a malicious user could fill up the server causing a Denial of Service or content injection.
[https://github.com/oliversalzburg/i18n-node-angular/commit/877720d2d9bb90dc8233706e81ffa03f99fc9dc8]
[https://nodesecurity.io/advisories/80]
When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass authentication.
[https://github.com/dwyl/hapi-auth-jwt2/issues/111]
[https://github.com/dwyl/hapi-auth-jwt2/pull/112]
[https://nodesecurity.io/advisories/81]
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
[https://github.com/tschaub/grunt-gh-pages/pull/41]
[https://nodesecurity.io/advisories/85]
The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.
[https://github.com/riot/compiler/issues/46]
[https://nodesecurity.io/advisories/86]
restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Restafary before 1.6.1 is able to set up a root path, which should only allow it to run inside of that root path it specified.
[https://nodesecurity.io/advisories/89]
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
[https://nodesecurity.io/advisories/91]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-301]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.
[https://github.com/airbrake/node-airbrake/issues/70]
[https://nodesecurity.io/advisories/96]
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (`sanitize: true`) to inject a `javascript:` URL. This flaw exists because `&#xNNanything;` gets parsed to what it could and leaves the rest behind, resulting in just `anything;` being left.
[https://github.com/chjj/marked/pull/592]
[https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523]
[https://nodesecurity.io/advisories/101]
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
[https://nodesecurity.io/advisories/90]
express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earlier and 3.0.X through 3.0.1 allows a malicious user to send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This can be used for other private data if the malicious user knew what was set as private for specific routes.
[https://github.com/florianholzapfel/express-restify-mongoose/issues/252]
[https://nodesecurity.io/advisories/92]
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.
[https://github.com/electron-userland/electron-packager/issues/333]
[https://nodesecurity.io/advisories/104]
csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present.
[https://github.com/isaacs/csrf-lite/pull/1]
[https://nodesecurity.io/advisories/94]
engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, certificate verification will be disabled. This is problematic as engine.io-client 1.6.8 and earlier passes in an object for settings that includes the rejectUnauthorized property, whether it has been set or not. If the value has not been explicitly changed, it will be passed in as `null`, resulting in certificate verification being turned off.
[https://github.com/socketio/engine.io-client/commit/2c55b278a491bf45313ecc0825cf800e2f7ff5c1]
[https://nodesecurity.io/advisories/99]
[https://www.cigital.com/blog/node-js-socket-io/]
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.
[https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008]
[https://nodesecurity.io/advisories/108]
The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252]
[https://github.com/node-js-libs/cli/issues/81]
[https://nodesecurity.io/advisories/95]
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
[https://nodesecurity.io/advisories/106]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-302]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
[https://nodesecurity.io/advisories/118]
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
[https://nodesecurity.io/advisories/117]
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
[https://github.com/nodejs/node/issues/7388]
[https://nodesecurity.io/advisories/120]
call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 that does not validate empty parameters, which could result in invalid input bypassing the route validation rules.
[https://github.com/hapijs/hapi/issues/3228]
[https://nodesecurity.io/advisories/121]
uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate enabled, there is a possibility used compression will shrink said 256mb down to less than 16mb of websocket payload which passes the length check of 16mb payload. This data will then inflate up to 256mb and crash the node process by exceeding V8's maximum string size. This affects uws >=0.10.0 <=0.10.8.
[https://github.com/uWebSockets/uWebSockets/commit/37deefd01f0875e133ea967122e3a5e421b8fcd9]
[https://nodesecurity.io/advisories/149]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands.
[https://nodesecurity.io/advisories/143]
Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS) vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as `name[]=<script>alert(1)</script>`, it is possible to bypass autoescaping and inject content into the DOM.
[https://github.com/matt-/nunjucks_test]
[https://github.com/mozilla/nunjucks/issues/835]
[https://nodesecurity.io/advisories/147]
Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.
[https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc9]
[https://nodesecurity.io/advisories/144]
Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the CORS configuration where the value of the origin header is reflected as the value for the Access-Control-Allow-Origin header. This would allow an attacker to make AJAX requests to vulnerable hosts through cross site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. Note that this is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. The problem can be compounded when the cors `credentials` setting is not provided. At that point authenticated cross domain requests are possible.
[http://sailsjs.org/documentation/concepts/security/cors]
[http://sailsjs.org/documentation/reference/configuration/sails-config-cors]
[https://nodesecurity.io/advisories/148]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-303]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
[https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03]
[https://nodesecurity.io/advisories/112]
waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.
[https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530]
[https://nodesecurity.io/advisories/115]
igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
[https://nodesecurity.io/advisories/116]
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.1.3 and earlier.
[https://github.com/sequelize/sequelize/blob/master/changelog.md#300]
[https://nodesecurity.io/advisories/109]
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL backslash escaping, even though SQLite uses Postgres escaping.
[https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d]
[https://nodesecurity.io/advisories/113]
Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.
[https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/]
[https://github.com/hokaccha/node-jwt-simple/pull/14]
[https://github.com/hokaccha/node-jwt-simple/pull/16]
[https://nodesecurity.io/advisories/87]
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This causes potential SQL injection in sequelize 3.19.3 and earlier, where a malicious user could put `["test", "'); DELETE TestTable WHERE Id = 1 --')"]` inside of ``` database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } }); ``` and cause the SQL statement to become `SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')`. In Postgres, MSSQL, and SQLite, the backslash has no special meaning. This causes the the statement to delete whichever Id has a value of 1 in the TestTable table.
[https://github.com/sequelize/sequelize/issues/5671]
[https://nodesecurity.io/advisories/102]
appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/162]
aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/167]
selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/164]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-304]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/170]
Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnerability that is exploitable via the URL path in GET requests.
[https://nodesecurity.io/advisories/150]
iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/174]
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
[https://github.com/diasdavid/go-ipfs-dep/pull/12]
[https://nodesecurity.io/advisories/156]
apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/195]
operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/196]
install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/204]
product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/171]
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/183]
embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/187]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-305]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/189]
bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/220]
mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/235]
baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/240]
apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/245]
Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/251]
Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/278]
ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://github.com/ibmdb/node-ibm_db/commit/d7e2d4b4cbeb6f067df8bba7d0b2ac5d40fcfc19#diff-315091eb1586966006e05ebc21cd2a94]
[https://nodesecurity.io/advisories/163]
unicode loads unicode data downloaded from unicode.org into nodejs. Unicode before 9.0.0 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/161]
Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/160]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-306]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/173]
Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity. steroids downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/168]
closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/169]
closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/165]
dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/181]
libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/178]
macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/180]
wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/179]
nw is an installer for nw.js. nw downloads zipped resources over HTTP, It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/166]
selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/175]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-307]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/190]
Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/185]
jser-stat is a JSer.info stat library. jser-stat downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://github.com/jser/stat-js/blob/master/data/url-mapping.js]
[https://nodesecurity.io/advisories/188]
ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. Before 2.5.6, it may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://gitlord.com/commitdiff/~dchem%2Fnode-ibapi-addon.git/c00dd7c98cca0423052148337e523eeb7776da68]
[https://gitlord.com/summary/~dchem%2Fnode-ibapi-addon.git]
[https://nodesecurity.io/advisories/182]
[https://www.npmjs.com/package/ibapi/v/2.5.6]
ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net. ipip downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/184]
jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested file with an attacker controlled file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/198]
imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/194]
cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/197]
arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/192]
sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/186]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-308]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/176]
webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/193]
haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/177]
air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/200]
dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/199]
dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/209]
grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/207]
openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/208]
robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/201]
chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/203]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-309]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
unicode-json is a unicode lookup table. unicode-json before 2.0.0 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/206]
strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/202]
dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/205]
bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/211]
httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/210]
curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/215]
openframe-image is an Openframe extension which adds support for images via fbi. openframe-image downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/218]
box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/219]
node-browser is a wrapper webdriver by nodejs. node-browser downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/214]
pennyworth is a natural language templating engine. pennyworth downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/213]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, and CVE-2016-1117.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-310]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/216]
fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/217]
nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/212]
macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/221]
selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/222]
headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/230]
mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/229]
scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/227]
selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/224]
nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/226]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-311]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/228]
jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/225]
apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/223]
dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/232]
scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/231]
broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/242]
grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/239]
haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/237]
js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/241]
redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/238]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/236]
node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/234]
cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/233]
jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/244]
slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/243]
grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/255]
resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/254]
node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/250]
marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/252]
frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/247]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-312]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/253]
webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/246]
prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/248]
xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/257]
sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
[https://nodesecurity.io/advisories/256]
The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/265]
qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/266]
co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/268]
native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/263]
poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/271]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-313]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/269]
phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/262]
tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/267]
wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/264]
mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/259]
herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://github.com/samatt/Herbivore/commit/0a041defc3463e99948e5d2064aef54b2128c5a3]
[https://nodesecurity.io/advisories/258]
tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/261]
selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/260]
libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/272]
soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/270]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-315]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/281]
mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/280]
cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/282]
ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.
[https://nodesecurity.io/advisories/279]
limbus-buildgen is a "build anywhere" build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/276]
libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/275]
rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/273]
google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/274]
serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/277]
selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/284]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-316]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources over HTTP, which leaves it vulnerable to MITM attacks. This impacts the integrity and availability of this geoip data that may alter the decisions made by an application using this data.
[https://nodesecurity.io/advisories/283]
roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/292]
massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/290]
arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/286]
healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/288]
pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/289]
fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/287]
windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/285]
Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/294]
The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/293]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-317]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/298]
windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/296]
haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/300]
pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/299]
alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/172]
The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/297]
windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/295]
react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/302]
mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
[https://nodesecurity.io/advisories/301]
D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs.
[101622]
[https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-018/?fid=8411]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-318]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
[http://bugs.cacti.net/view.php?id=2697]
[http://www.cacti.net/release_notes_1_0_0.php]
[https://github.com/Cacti/cacti/commit/69983495cd41bf0903fe02baeef84b1fa85f2846]
[https://web.archive.org/web/20160817090458/http://bugs.cacti.net/view.php?id=2697]
In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.
[http://jira.pentaho.com/browse/BISERVER-13207]
[http://jira.pentaho.com/browse/BISERVER-3562]
[http://jira.pentaho.com/browse/BISERVER-6599]
[102200]
Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary application's JavaScript instance, by modifying a UUID value within the header of a crafted application binary.
[https://blog.fletchto99.com/2016/november/pebble-app-sandbox-escape/]
A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
[https://github.com/jfhbrook/node-ecstatic/commit/71ce93988ead4b561a8592168c72143907189f01]
[https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/]
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
[https://magento.com/security/patches/magento-2010-and-212-security-update]
The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.
[https://jetpack.com/2016/06/20/jetpack-4-0-4-bug-fixes/]
[https://wpvulndb.com/vulnerabilities/8517]
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.
[https://jetpack.com/2016/05/27/jetpack-4-0-3-critical-security-update/]
[https://www.wordfence.com/blog/2016/05/jetpack-vulnerability/]
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
[https://github.com/jquery/jquery/issues/3133]
[https://github.com/jquery/jquery/pull/3134]
[https://snyk.io/vuln/npm:jquery:20160529]
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
[http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html]
[102780]
[https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10284]
[[debian-lts-announce] 20180126 [SECURITY] [DLA 1257-1] openssh security update]
[[debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update]
[https://security.netapp.com/advisory/ntap-20180423-0003/]
[USN-3809-1]
[https://www.openssh.com/releasenotes.html]
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
[39709]
[https://www.pfsense.org/security/advisories/pfSense-SA-16_01.webgui.asc]
[https://www.rapid7.com/db/modules/exploit/unix/http/pfsense_graph_injection_exec]
[https://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-319]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix.
[http://threat.tevora.com/biscom-secure-file-transfer-arbitrary-file-download/]
Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
[http://www.apsis.ch/pound/pound_list/archive/2016/2016-10/1477235279000]
[[debian-lts-announce] 20180212 [SECURITY] [DLA 1280-1] pound security update]
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a "$uri = stream_get_meta_data(fopen($file, "r"))['uri']" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.
[https://bugs.php.net/bug.php?id=71323]
[https://git.php.net/?p=php-src.git;a=commit;h=6297a117d77fa3a0df2e21ca926a92c231819cd5]
[USN-3566-2]
[USN-3600-1]
An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.
[103063]
[RHSA-2019:2033]
[https://git.savannah.gnu.org/cgit/patch.git/commit/src/pch.c?id=a0d7fe4589651c64bd16ddaaa634030bb0455866]
[USN-3624-1]
[USN-3624-2]
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
[https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60]
[USN-3593-1]
The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPage.jspa?kanbanId=7#/kanban-view URI.
[https://packetstormsecurity.com/files/137648/JIRA-Artezio-Board-1.4-Cross-Site-Scripting-Information-Disclosure.html]
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspa#period/month URI.
[https://marketplace.atlassian.com/plugins/ru.mail.jira.plugins.mailrucal/versions]
[https://packetstormsecurity.com/files/137649/JIRA-Mail.ru-Calendar-2.4.2.50_JIRA6-Cross-Site-Scripting.html]
A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.
[http://www.securitytube.net/video/16690]
[https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/]
[https://github.com/mspaling/mbam-exclusions-poc-]
[https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt]
[https://www.youtube.com/watch?v=LF5ic5nOoUY]
Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
[https://github.com/brave/browser-laptop/issues/5006]
[https://github.com/brave/browser-laptop/issues/5007]
[https://hackerone.com/reports/176197]
[44475]
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password.
[https://packetstormsecurity.com/files/138881/TP-Link-Archer-CR-700-Cross-Site-Scripting.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-320]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application.
[https://github.com/Thomas-Tsai/partclone/issues/82]
partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock, related to the mark_reserved_sectors function. An attacker may be able to execute arbitrary code in the context of the user running the affected application.
[https://david.gnedt.at/blog/2016/11/14/advisory-partclone-fat-bitmap-heap-overflow/]
[https://github.com/Thomas-Tsai/partclone/issues/71]
** DISPUTED ** An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle."
[https://patchwork.kernel.org/patch/10395909/]
[https://patchwork.kernel.org/patch/9842889/]
[https://www.spinics.net/lists/linux-mm/msg117896.html]
Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
[https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure]
[https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures]
[https://github.com/JinBean/CVE-Extension]
[https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html]
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
[https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure]
[https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures]
[https://github.com/JinBean/CVE-Extension]
[https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html]
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
[https://github.com/DSpace/DSpace/releases/tag/dspace-5.5]
[https://jira.duraspace.org/browse/DS-3094]
[https://wiki.duraspace.org/display/DSDOC5x/Release+Notes]
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.
[https://bugzilla.redhat.com/show_bug.cgi?id=1334842]
[https://github.com/GNOME/evolution-data-server/releases/tag/EVOLUTION_DATA_SERVER_3_21_2]
[https://gitlab.gnome.org/GNOME/evolution-data-server/blob/master/NEWS#L1022]
[https://gitlab.gnome.org/GNOME/evolution-data-server/commit/f26a6f67]
[USN-3724-1]
An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.
[https://github.com/kirillwow/ids_bypass]
[[debian-lts-announce] 20180919 [SECURITY] [DLA 1508-1] suricata security update]
[https://redmine.openinfosecfoundation.org/issues/1880]
[https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/]
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
[39217]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-321]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API script. It should not be run by users directly. It uses star to backup and restore data. It runs binaries with root permissions when parsing the command line argument --star-path.
[39244]
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
[https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/]
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
[https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/]
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
[https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/]
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
[https://github.com/sandboxescape/ProjectSend-multiple-vulnerabilities/]
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
[RHBA-2019:1076]
[RHBA-2019:1570]
[RHSA-2019:1456]
[RHSA-2019:3023]
[https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/]
[https://github.com/twbs/bootstrap/issues/20184]
[https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906]
[https://github.com/twbs/bootstrap/pull/23679]
[https://github.com/twbs/bootstrap/pull/23687]
[https://github.com/twbs/bootstrap/pull/26460]
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
[https://advisories.dxw.com/advisories/reflected-xss-in-social-pug-easy-social-share-buttons-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/]
Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.
[40650]
Zenbership v107 has CSRF via admin/cp-functions/event-add.php.
[40620]
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
[openSUSE-SU-2019:1250]
[106672]
[RHSA-2019:2118]
[https://bugzilla.redhat.com/show_bug.cgi?id=1347549]
[https://sourceware.org/bugzilla/show_bug.cgi?id=20018]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-322]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources.
[https://jira.atlassian.com/browse/CWD-5060]
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=04197b341f23b908193308b8d63d17ff23232598]
[106822]
[https://bugzilla.suse.com/show_bug.cgi?id=1124010]
[https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.3]
[https://github.com/torvalds/linux/commit/04197b341f23b908193308b8d63d17ff23232598]
[[debian-lts-announce] 20190327 [SECURITY] [DLA 1731-1] linux security update]
[[debian-lts-announce] 20190401 [SECURITY] [DLA 1731-2] linux regression update]
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
[[debian-lts-announce] 20190311 [SECURITY] [DLA 1708-1] zabbix security update]
[https://support.zabbix.com/browse/ZBX-10272]
[https://support.zabbix.com/browse/ZBX-13133]
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
[[debian-lts-announce] 20190328 [SECURITY] [DLA 1733-1] wpa security update]
[USN-3944-1]
[https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389]
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
[https://github.com/select2/select2/issues/4587]
[https://github.com/snipe/snipe-it/pull/6831]
[https://github.com/snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a]
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
[openSUSE-SU-2019:1395]
[openSUSE-SU-2019:1614]
[RHSA-2019:1022]
[RHSA-2019:1237]
[RHSA-2019:1260]
[https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16]
[https://palletsprojects.com/blog/jinja-281-released/]
[USN-4011-1]
[USN-4011-2]
libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
[https://github.com/libvirt/libvirt/commit/506e9d6c2d4baaf580d489fff0690c0ff2ff588f]
[https://github.com/libvirt/libvirt/compare/11288f5...8fd6867]
[[debian-lts-announce] 20190430 [SECURITY] [DLA 1772-1] libvirt security update]
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
[https://github.com/DaveGamble/cJSON/commit/94df772485c92866ca417d92137747b2e3b0a917]
[https://github.com/DaveGamble/cJSON/issues/30]
[https://www.openwall.com/lists/oss-security/2016/11/07/2]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-323]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
[RHSA-2019:2413]
[https://github.com/hazelcast/hazelcast/issues/8024]
[https://github.com/hazelcast/hazelcast/pull/12230]
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
[https://blog.ripstech.com/2016/osclass-remote-code-execution-via-image-file/]
[https://demo.ripstech.com/projects/osclass_3.6.1]
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
[https://blog.ripstech.com/2016/serendipity-from-file-upload-to-code-execution/]
[https://demo.ripstech.com/projects/serendipity_2.0.3]
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
[https://blog.ripstech.com/2016/e107-sql-injection-through-object-injection/]
[https://demo.ripstech.com/projects/e107_2.1.2]
modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.
[https://blog.ripstech.com/2016/vtiger-sql-injection/]
[https://demo.ripstech.com/projects/vtiger_6.5.0]
AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php.
[https://blog.ripstech.com/2016/abantecart-multiple-sql-injections/]
[https://demo.ripstech.com/projects/abantecart_1.2.8]
Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.
[https://blog.ripstech.com/2016/kliqqi-from-cross-site-request-forgery-to-code-execution/]
[https://demo.ripstech.com/projects/kliqqi_3.0.0.5]
In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.
[https://blog.ripstech.com/2016/redaxo-remote-code-execution-via-csrf/]
[https://demo.ripstech.com/projects/redaxo_5.2.0]
PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the image_name parameter.
[https://blog.ripstech.com/2016/phpkit-code-exection-for-privileged-users/]
[https://demo.ripstech.com/projects/phpkit_1.6.6]
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.
[https://blog.ripstech.com/2016/precurio-remote-command-execution-via-xinha-plugin/]
[https://demo.ripstech.com/projects/precurio_2.1]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-324]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.
[https://ethical-hacker.org/en/seowonintech-remote-root/]
Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.
[https://github.com/BastilleResearch/mousejack/blob/master/doc/advisories/bastille-2.logitech.public.txt]
[https://www.kb.cert.org/vuls/id/981271]
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
[https://hackerone.com/reports/151516]
[https://wordpress.org/plugins/camptix/#developers]
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
[https://hackerone.com/reports/152958]
[https://wordpress.org/plugins/camptix/#developers]
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
[https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=193e87143c290ec16838f5368adc0e0bc94eb931]
[https://github.com/torvalds/linux/commit/193e87143c290ec16838f5368adc0e0bc94eb931]
[https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.6]
[https://support.f5.com/csp/article/K24444495]
[https://support.f5.com/csp/article/K24444495?utm_source=f5support&utm_medium=RSS]
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
[https://open.edx.org/announcements/security-alert-account-activation-unverified-email/]
edx-platform before 2016-06-06 allows CSRF.
[https://github.com/edx/edx-platform/commit/d54f79f5bf3e1af17063937df1abc0026843412d.patch]
[https://open.edx.org/announcements/cross-site-request-forgery-bug-edx-lms/]
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0006-full-disclosure/]
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[http://packetstormsecurity.com/files/137035/Adobe-Reader-DC-15.010.20060-Memory-Corruption.html]
[1035828]
[https://0patch.blogspot.com/2016/06/writing-0patch-for-acrobat-readers-use.html]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
[39799]
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0006-full-disclosure/]
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0006-full-disclosure/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-325]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1092.
[90511]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-326]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
[https://documentation.cpanel.net/display/CL/60+Change+Log]
cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-327]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0004-full-disclosure/]
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
[https://documentation.cpanel.net/display/CL/58+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2016-0002-full-disclosure.534481/]
In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0002-full-disclosure/]
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
[https://documentation.cpanel.net/display/CL/56+Change+Log]
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/]
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/]
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/]
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/]
cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-full-disclosure.522571/]
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2015-0006-full-disclosure/]
cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://forums.cpanel.net/threads/cpanel-tsr-2015-0006-full-disclosure.510181/]
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
[https://news.cpanel.com/cpanel-tsr-2015-0006-full-disclosure/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
[https://documentation.cpanel.net/display/CL/54+Change+Log]
Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
[https://www.pentestpartners.com/security-blog/a-neet-csrf-to-reverse-shell-in-wi-fi-music-streamer/]
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
[https://www.pentestpartners.com/security-blog/a-neet-csrf-to-reverse-shell-in-wi-fi-music-streamer/]
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
[https://www.pentestpartners.com/security-blog/edimax-wi-fi-extender-can-disclose-your-wpa-key/]
NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
[https://www.pentestpartners.com/security-blog/netgear-ex7000-wi-fi-range-extender-minor-xss-and-poor-password-handling/]
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
[https://wordpress.org/plugins/lightbox-plus/#developers]
[https://www.pluginvulnerabilities.com/2016/04/05/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-lightbox-plus-colorbox/]
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers]
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
[https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers]
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
[https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers]
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
[https://wordpress.org/plugins/contact-form-plugin/#developers]
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1090 and CVE-2016-4106.
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[90513]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
[https://wordpress.org/plugins/google-language-translator/#developers]
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
[https://wordpress.org/plugins/mailchimp-for-wp/#developers]
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
[https://wordpress.org/plugins/ultimate-member/#developers]
[https://wpvulndb.com/vulnerabilities/9738]
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
[https://wordpress.org/plugins/wp-database-backup/#developers]
[https://wpvulndb.com/vulnerabilities/9739]
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
[https://wordpress.org/plugins/wp-database-backup/#developers]
[https://wpvulndb.com/vulnerabilities/9739]
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
[https://wordpress.org/plugins/wp-database-backup/#developers]
[https://wpvulndb.com/vulnerabilities/9740]
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
[https://wordpress.org/plugins/wp-database-backup/#developers]
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/wp-editor/#developers]
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
[https://wordpress.org/plugins/wp-google-map-plugin/#developers]
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
[https://wordpress.org/plugins/wp-live-chat-support/#developers]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
[https://wordpress.org/plugins/google-document-embedder/#developers]
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
[https://wordpress.org/plugins/google-document-embedder/#developers]
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
[https://wordpress.org/plugins/google-document-embedder/#developers]
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
[https://wordpress.org/plugins/simple-add-pages-or-posts/#developers]
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
[https://wordpress.org/plugins/simple-membership/#developers]
[https://wpvulndb.com/vulnerabilities/9744]
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
[https://wordpress.org/plugins/wp-editor/#developers]
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
[https://wordpress.org/plugins/wp-editor/#developers]
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
[https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers]
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
[https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/#developers]
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
[https://wordpress.org/plugins/nextgen-gallery/#developers]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
[93491]
[1036986]
[https://helpx.adobe.com/security/products/acrobat/apsb16-33.html]
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
[https://wordpress.org/plugins/aryo-activity-log/#developers]
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
[https://wordpress.org/plugins/aryo-activity-log/#developers]
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/chained-quiz/#developers]
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
[https://wordpress.org/plugins/crayon-syntax-highlighter/#developers]
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
[https://bugs.debian.org/830726]
[[debian-lts-announce] 20191014 [SECURITY] [DLA 1959-1] xtrlock security update]
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
[https://wordpress.org/plugins/option-tree/#developers]
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
[https://wordpress.org/plugins/seo-redirection/#developers]
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/sermon-browser/#developers]
The total-security plugin before 3.4.1 for WordPress has XSS.
[https://wordpress.org/plugins/total-security/#developers]
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
[https://wordpress.org/plugins/total-security/#developers]
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-4106.
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[90513]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The uji-countdown plugin before 2.0.7 for WordPress has XSS.
[https://wordpress.org/plugins/uji-countdown/#developers]
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
[https://wordpress.org/plugins/wp-customer-reviews/#developers]
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
[https://wordpress.org/plugins/wp-customer-reviews/#developers]
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
[https://wordpress.org/plugins/godaddy-email-marketing-sign-up-forms/#developers]
The olimometer plugin before 2.57 for WordPress has SQL injection.
[https://wordpress.org/plugins/olimometer/#developers]
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=36e4ad0316c017d5b271378ed9a1c9a4b77fab5f]
[[debian-lts-announce] 20190925 [SECURITY] [DLA 1930-1] linux security update]
[https://support.f5.com/csp/article/K31332013]
[https://support.f5.com/csp/article/K31332013?utm_source=f5support&utm_medium=RSS]
[USN-4145-1]
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c278c253f3d992c6994d08aa0efb2b6806ca396f]
An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
[https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.6]
[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d47964bfd471f0dd4c89f28556aec68bffa0020]
[https://support.f5.com/csp/article/K79609038]
[https://support.f5.com/csp/article/K79609038?utm_source=f5support&utm_medium=RSS]
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
[https://wordpress.org/plugins/booking-calendar-contact-form/#developers]
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
[https://wordpress.org/plugins/booking-calendar-contact-form/#developers]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
[93491]
[1036986]
[https://helpx.adobe.com/security/products/acrobat/apsb16-33.html]
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/formbuilder/#developers]
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
[https://wordpress.org/plugins/profile-builder/#developers]
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
[https://wordpress.org/plugins/universal-analytics/#developers]
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
[https://wordpress.org/plugins/wp-latest-posts/#developers]
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
[https://wordpress.org/plugins/add-from-server/#developers]
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
[https://wordpress.org/plugins/popup-by-supsystic/#developers]
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
[https://wordpress.org/plugins/appointment-booking-calendar/#developers]
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
[https://wordpress.org/plugins/search-everything/#developers]
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
[https://wordpress.org/plugins/gallery-by-supsystic/#developers]
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
[https://wordpress.org/plugins/wassup/#developers]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1079.
[90511]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
[https://wordpress.org/plugins/gnucommerce/#developers]
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
[https://wordpress.org/plugins/gallery-photo-gallery/#developers]
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
[https://wordpress.org/plugins/woocommerce-store-toolkit/#developers]
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
[https://wordpress.org/plugins/woocommerce-store-toolkit/#developers]
The ebook-download plugin before 1.2 for WordPress has directory traversal.
[https://wordpress.org/plugins/ebook-download/#developers]
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
[https://wordpress.org/plugins/peters-login-redirect/#developers]
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
[https://wordpress.org/plugins/nelio-ab-testing/#developers]
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
[https://wordpress.org/plugins/nelio-ab-testing/#developers]
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
[https://github.com/onelogin/wordpress-saml/commit/fbe808e2fd8fde8cb7e6bf365c5334b5702262da]
[https://wordpress.org/plugins/onelogin-saml-sso/#developers]
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
[https://wordpress.org/plugins/advanced-ajax-page-loader/#developers]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
[https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/#developers]
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
[https://rustsec.org/advisories/RUSTSEC-2016-0001.html]
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
[https://rustsec.org/advisories/RUSTSEC-2016-0002.html]
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
[https://rustsec.org/advisories/RUSTSEC-2016-0003.html]
The check-email plugin before 0.5.2 for WordPress has XSS.
[https://wordpress.org/plugins/check-email/#developers]
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
[https://wordpress.org/plugins/woocommerce-exporter/#developers]
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
[https://wordpress.org/plugins/wp-polls/#developers]
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
[https://bugs.debian.org/939702]
[https://github.com/lefcha/imapfilter/issues/142]
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
[https://advisories.dxw.com/advisories/copy-me-vulnerable-to-csrf-allowing-unauthenticated-attacker-to-copy-posts/]
[https://wordpress.org/plugins/copy-me/#developers]
[https://wpvulndb.com/vulnerabilities/8706]
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
[http://lenonleite.com.br/en/blog/2016/12/16/xtreme-locator-dealer-locator-plugin-wordpress-sql-injection/]
[https://wordpress.org/plugins/xtremelocator/#developers]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-328]
[http://www.zerodayinitiative.com/advisories/ZDI-16-359]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
[http://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/]
[https://wordpress.org/plugins/zm-gallery/#developers]
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
[https://blog.ripstech.com/2016/the-state-of-wordpress-security/]
[https://github.com/podlove/podlove-publisher/blob/master/changelog.txt]
[https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/#developers]
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
[https://blog.ripstech.com/2016/the-state-of-wordpress-security/]
[https://github.com/podlove/podlove-publisher/blob/master/changelog.txt]
[https://wordpress.org/plugins/podlove-podcasting-plugin-for-wordpress/#developers]
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
[http://lenonleite.com.br/en/2016/12/16/english-zx_csv-upload-1-plugin-wordpress-sql-injection/]
[https://wordpress.org/plugins/zx-csv-upload/#developers]
[https://wpvulndb.com/vulnerabilities/8702]
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
[https://advisories.dxw.com/advisories/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do/]
[https://wordpress.org/plugins/multisite-post-duplicator/#developers]
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
[https://klikki.fi/adv/pagelines.html]
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
[https://wordpress.org/plugins/wp-d3/#developers]
[https://wpvulndb.com/vulnerabilities/8679]
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
[https://advisories.dxw.com/advisories/sql-injection-in-post-indexer-allows-super-admins-to-read-the-contents-of-the-database/]
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
[https://advisories.dxw.com/advisories/unserialisation-in-post-indexer-could-allow-man-in-the-middle-to-execute-arbitrary-code-in-some-circumstances/]
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
[https://advisories.dxw.com/advisories/sql-injection-and-unserialization-vulnerability-in-relevanssi-premium-could-allow-admins-to-execute-arbitrary-code-in-some-circumstances/]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-329]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
[http://lenonleite.com.br/en/2016/11/10/sirv-1-3-1-plugin-for-wordpress/]
[https://wordpress.org/plugins/sirv/#developers]
[https://wpvulndb.com/vulnerabilities/8673]
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
[http://lenonleite.com.br/en/2016/11/10/firestorm-shopping-cart-ecommerce-plugin-2-07-02-for-wordpress/]
[https://wordpress.org/plugins/fs-shopping-cart/#developers]
[https://wpvulndb.com/vulnerabilities/8672]
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
[https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_quotes_collection_wordpress_plugin.html]
[https://wordpress.org/plugins/quotes-collection/#developers]
[https://wpvulndb.com/vulnerabilities/8649]
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
[https://wptavern.com/headway-3-8-9-patches-potential-xss-vulnerability]
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
[https://lifeforms.nl/20160919/unrestricted-upload-neosense]
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
[https://wordpress.org/plugins/cysteme-finder/#developers]
[https://wpvulndb.com/vulnerabilities/8612]
The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
[https://cxsecurity.com/issue/WLB-2016080220]
[https://wordpress.org/plugins/mail-masta/#developers]
[https://wpvulndb.com/vulnerabilities/8609]
The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
[https://wpvulndb.com/vulnerabilities/8607]
[https://www.saotn.org/wordpress-advisory-akal-theme-xss-vulnerability/]
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
[https://estatik.net/estatik-released-security-updates/]
[https://wordpress.org/plugins/estatik/#developers]
[https://www.pluginvulnerabilities.com/2016/08/01/arbitrary-file-upload-vulnerability-in-estatik/]
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
[https://wordpress.org/plugins/estatik/#developers]
[https://www.pluginvulnerabilities.com/2016/08/19/authenticated-arbitrary-file-upload-vulnerability-in-estatik/]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137051/Adobe-Flash-MP4-File-Stack-Corruption.html]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39828]
The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
[https://wordpress.org/plugins/wsecure/#developers]
[https://www.pluginvulnerabilities.com/2016/07/12/remote-code-execution-rce-vulnerability-in-wsecure-lite/]
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
[https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_colorway_wordpress_theme.html]
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
[https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_icegram_wordpress_plugin.html]
[https://wordpress.org/plugins/icegram/#developers]
The icegram plugin before 1.9.19 for WordPress has XSS.
[https://wordpress.org/plugins/icegram/#developers]
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
[https://rastating.github.io/dwnldr-1-0-stored-xss-disclosure/]
[https://wordpress.org/plugins/dwnldr/#developers]
The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
[https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/]
[https://wordpress.org/plugins/real3d-flipbook-lite/#developers]
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
[https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/]
[https://wordpress.org/plugins/real3d-flipbook-lite/#developers]
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
[https://mukarramkhalid.com/wordpress-real-3d-flipbook-plugin-exploit/]
[https://wordpress.org/plugins/real3d-flipbook-lite/#developers]
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
[http://www.pritect.net/blog/peepso-1-6-0-logged-user-privilege-escalation]
[https://wordpress.org/plugins/peepso-core/#developers]
The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
[https://github.com/SupportFlow/supportflow/commit/c08d376072f093b650c49dcb44124f43ea0177b1]
[https://wordpress.org/plugins/supportflow/#developers]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
[https://github.com/SupportFlow/supportflow/commit/c507cc863d161f87c28d0682714bf188ffac1a67]
[https://wordpress.org/plugins/supportflow/#developers]
The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
[http://www.pritect.net/blog/membersonic-lite-1-2-unauthenticated-login]
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
[https://wpvulndb.com/vulnerabilities/8852]
[Exploit Database]
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
[https://wpvulndb.com/vulnerabilities/8614]
[https://www.openwall.com/lists/oss-security/2016/05/20/5]
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
[https://klikki.fi/adv/fluid_responsive_slideshow.html]
[https://wordpress.org/plugins/fluid-responsive-slideshow/#developers]
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
[https://klikki.fi/adv/fluid_responsive_slideshow.html]
[https://wordpress.org/plugins/fluid-responsive-slideshow/#developers]
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
[https://wordpress.org/plugins/safe-editor/#developers]
[https://wpvulndb.com/vulnerabilities/8497]
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
[https://wordpress.org/plugins/nelio-ab-testing/#developers]
[https://wpvulndb.com/vulnerabilities/8491]
[https://www.openwall.com/lists/oss-security/2016/05/10/1]
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
[https://wordpress.org/plugins/fossura-tag-miner/#developers]
[https://wpvulndb.com/vulnerabilities/8486]
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
[https://wordpress.org/plugins/fossura-tag-miner/#developers]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
[https://wordpress.org/plugins/kento-post-view-counter/#developers]
[https://www.openwall.com/lists/oss-security/2016/04/16/2]
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
[https://wordpress.org/plugins/kento-post-view-counter/#developers]
[https://www.openwall.com/lists/oss-security/2016/04/16/3]
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
[https://wordpress.org/plugins/kento-post-view-counter/#developers]
[https://www.openwall.com/lists/oss-security/2016/04/16/3]
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
[https://packetstormsecurity.com/files/136887/]
[https://wordpress.org/plugins/ghost/#developers]
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
[https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability/]
[https://wordpress.org/plugins/echosign/#developers]
[https://wpvulndb.com/vulnerabilities/8465]
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
[https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability/]
[https://wordpress.org/plugins/echosign/#developers]
[https://wpvulndb.com/vulnerabilities/8465]
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
[https://0x62626262.wordpress.com/2016/04/21/tweet-wheel-xss-vulnerability/]
[https://wordpress.org/plugins/tweet-wheel/#developers]
[https://wpvulndb.com/vulnerabilities/8464]
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
[https://0x62626262.wordpress.com/2016/04/21/persian-woocommerce-sms-xss-vulnerability/]
[https://wordpress.org/plugins/persian-woocommerce-sms/#developers]
[https://wpvulndb.com/vulnerabilities/8463]
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
[https://wordpress.org/plugins/leenkme/#developers]
[https://wpvulndb.com/vulnerabilities/8457]
[https://www.openwall.com/lists/oss-security/2016/04/16/4]
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
[https://wordpress.org/plugins/leenkme/#developers]
[https://wpvulndb.com/vulnerabilities/8457]
[https://www.openwall.com/lists/oss-security/2016/04/16/4]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
[https://wordpress.org/plugins/wp-cerber/#developers]
[https://wpvulndb.com/vulnerabilities/8430]
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
[https://wordpress.org/plugins/imdb-widget/#developers]
[https://wpvulndb.com/vulnerabilities/8426]
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
[https://packetstormsecurity.com/files/136445/]
[https://wordpress.org/plugins/music-store/#developers]
[https://wpvulndb.com/vulnerabilities/8429]
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
[https://www.vulnerability-lab.com/get_content.php?id=1808]
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
[https://www.vulnerability-lab.com/get_content.php?id=1839]
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
[https://wpvulndb.com/vulnerabilities/8482]
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
[http://www.pritect.net/blog/optinmonster-1-1-4-6-security-vulnerability]
[https://wordpress.org/plugins/optinmonster/#developers]
The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
[https://wpvulndb.com/vulnerabilities/8412]
[Exploit Database]
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
[https://wpvulndb.com/vulnerabilities/8425]
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
[https://www.vulnerability-lab.com/get_content.php?id=1771]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
[https://seclists.org/bugtraq/2016/Feb/183]
[https://wordpress.org/plugins/wp-ultimate-exporter/#developers]
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
[https://wordpress.org/plugins/user-submitted-posts/#developers]
[https://www.securityfocus.com/archive/1/537616/30/0/threaded]
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
[http://www.pritect.net/blog/elegant-themes-security-vulnerability]
[https://wptavern.com/critical-security-vulnerability-discovered-in-elegant-themes-products]
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
[http://www.pritect.net/blog/elegant-themes-security-vulnerability]
[https://wptavern.com/critical-security-vulnerability-discovered-in-elegant-themes-products]
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
[http://www.pritect.net/blog/elegant-themes-security-vulnerability]
[https://wptavern.com/critical-security-vulnerability-discovered-in-elegant-themes-products]
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
[https://rastating.github.io/instalinker-reflected-xss-information-disclosure/]
[https://wordpress.org/plugins/instalinker/#developers]
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137052/Adobe-Flash-ATF-Processing-Heap-Overflow.html]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39827]
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
[http://www.pritect.net/blog/wp-invoice-4-1-1-security-vulnerabilities]
[https://wordpress.org/plugins/wp-invoice/#developers]
[https://wpvulndb.com/vulnerabilities/8378]
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
[https://wordpress.org/plugins/sola-support-tickets/#developers]
[https://wpvulndb.com/vulnerabilities/8389]
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
[https://github.com/agentevolution/wp-listings/pull/52]
[https://wordpress.org/plugins/wp-listings/#developers]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137053/Adobe-Flash-JXR-Processing-Out-Of-Bounds-Read.html]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39824]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137054/Adobe-Flash-Raw-565-Texture-Processing-Overflow.html]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39826]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137055/Adobe-Flash-Object-Placing-Out-Of-Bounds-Read.html]
[RHSA-2016:1079]
[90618]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39825]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137056/Adobe-Flash-FileReference-Type-Confusion.html]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39829]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[http://packetstormsecurity.com/files/137057/Adobe-Flash-SetNative-Use-After-Free.html]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
[39831]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
[SUSE-SU-2016:1305]
[RHSA-2016:1079]
[1035827]
[MS16-064]
[https://helpx.adobe.com/security/products/flash-player/apsb16-15.html]
Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary.
<a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a>
[http://www.zerodayinitiative.com/advisories/ZDI-16-273/]
[https://helpx.adobe.com/security/products/acrobat/apsb16-02.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information via unspecified vectors.
[90510]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[90507]
[1035829]
[https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html]
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
<a href="http://cwe.mitre.org/data/definitions/502.html">CWE-502: Deserialization of Untrusted Data</a>
[90506]
[https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html]
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
[90514]
[1035829]
[https://helpx.adobe.com/security/products/coldfusion/apsb16-16.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, and CVE-2016-1062.
[90517]
[1035828]
[http://www.zerodayinitiative.com/advisories/ZDI-16-285]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1094, CVE-2016-1121, CVE-2016-4102, and CVE-2016-4107.
<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>
[90512]
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
[1035828]
[https://helpx.adobe.com/security/products/acrobat/apsb16-14.html]
Buffer overflow in the CL_vsprintf function in Takumi Yamada DX Library before 3.16 allows remote attackers to execute arbitrary code via a crafted string.
[http://homepage2.nifty.com/natupaji/DxLib/dxvulnerability.html]
[JVN#49476817]
[JVNDB-2016-000001]
Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.
[JVN#47951769]
[JVNDB-2016-000004]
CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.
<a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[JVN#45928828]
[JVNDB-2016-000003]
[https://github.com/h2o/h2o/issues/682]
[https://github.com/h2o/h2o/issues/684]
[https://h2o.examp1e.net/vulnerabilities.html#CVE-2016-1133]
Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users.
[JVN#09268287]
[JVNDB-2016-000005]
Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#49225722]
[JVNDB-2016-000006]
Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[JVN#54686544]
[JVNDB-2016-000007]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
<a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>
[JVN#54686544]
[JVNDB-2016-000008]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors.
<a href="https://cwe.mitre.org/data/definitions/93.html">CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a>
[JVN#54686544]
[JVNDB-2016-000009]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[JVN#54686544]
[JVNDB-2016-000010]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
[JVN#54686544]
[JVNDB-2016-000011]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
[JVN#54686544]
[JVNDB-2016-000012]
[http://www.au.kddi.com/mobile/service/smartphone/wifi/homespot/#anc06]
Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
[JVN#50899877]
[JVNDB-2016-000002]
[http://www.acmailer.jp/info/de.cgi?id=64]
Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#12165579]
[JVNDB-2016-000016]
[https://github.com/ikeay/vinemv/commit/f41efbcac1f9262a161ebc1babfcf55fae9e939a]
Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[JVN#26921563]
[JVNDB-2016-000017]
[http://www.ws-download.net/info.php?type=version&id=V0001081]
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote attackers to read arbitrary files via unspecified vectors.
[http://jpn.nec.com/security-info/secinfo/nv16-001.html]
[JVN#03050861]
[JVNDB-2016-000015]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
[JVN#22578691]
[JVNDB-2016-000019]
[https://akerun.com/2016-02-12-akerun-ios-app-security-update/]
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1150.
[JVN#69278491]
[JVNDB-2016-000026]
[https://cs.cybozu.co.jp/2015/006072.html]
[https://cs.cybozu.co.jp/2015/006087.html]
[https://cs.cybozu.co.jp/2016/006107.html]
[https://cs.cybozu.co.jp/2016/006109.html]
Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.
[JVN#69278491]
[JVNDB-2016-000026]
[https://cs.cybozu.co.jp/2015/006072.html]
[https://cs.cybozu.co.jp/2015/006087.html]
[https://cs.cybozu.co.jp/2016/006107.html]
[https://cs.cybozu.co.jp/2016/006109.html]
Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users.
[JVN#64209269]
[JVNDB-2016-000024]
[https://cs.cybozu.co.jp/2016/006111.html]
Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.
[JVN#48720230]
[JVNDB-2016-000023]
[https://cs.cybozu.co.jp/2015/006076.html]
customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerability than CVE-2015-8489.
[JVN#20246313]
[JVNDB-2016-000020]
[https://cs.cybozu.co.jp/2016/006108.html]
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[JVN#31524757]
[JVNDB-2016-000027]
[http://www.ec-cube.net/products/detail.php?product_id=279]
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
[97662]
[https://android.googlesource.com/platform/external/okhttp/+/71b9f47b26fb57ac3e436a19519c6e3ec70e86eb]
[JVN#99757346]
LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline.
[JVN#46044093]
[JVNDB-2016-000029]
[http://linecorp.com/ja/security/article/53]
Cross-site scripting (XSS) vulnerability in log_chat.cgi in Script* Log-Chat before 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#93535632]
[JVNDB-2016-000031]
[http://r.o0o0.jp/sc/log-chat/]
Cross-site request forgery (CSRF) vulnerability on Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.
[http://corega.jp/support/security/20160229_wlbargmh_wlbargnl.htm]
[JVN#59349382]
[JVNDB-2016-000032]
Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#86517621]
[JVNDB-2016-000034]
[https://wordpress.org/plugins/wp-favorite-posts/changelog/]
Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500).
[http://jvn.jp/en/vu/JVNVU95113461/]
[91531]
[https://www.excellium-services.com/cert-xlm-advisory/cve-2016-1161/]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.
[http://jpn.nec.com/security-info/secinfo/nv16-005.html]
[JVN#82020528]
[JVNDB-2016-000036]
Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.
[http://jpn.nec.com/security-info/secinfo/nv16-004.html]
[JVN#07818796]
[JVNDB-2016-000035]
Cross-site scripting (XSS) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#55801246]
[JVNDB-2016-000044]
[https://hiniarata.jp/news/archives/55]
Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of administrators.
[JVN#55801246]
[JVNDB-2016-000045]
[https://hiniarata.jp/news/archives/55]
Cross-site scripting (XSS) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#13288761]
[JVNDB-2016-000040]
[https://hiniarata.jp/news/archives/55]
Cross-site request forgery (CSRF) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.
[JVN#13288761]
[JVNDB-2016-000041]
[https://hiniarata.jp/news/archives/55]
Cross-site scripting (XSS) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#26627848]
[JVNDB-2016-000042]
[https://hiniarata.jp/news/archives/55]
Cross-site request forgery (CSRF) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.
[JVN#26627848]
[JVNDB-2016-000043]
[https://hiniarata.jp/news/archives/55]
Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authentication of arbitrary users.
[JVN#47164236]
[JVNDB-2016-000039]
[http://www.sharp.co.jp/support/photoplayer/fw_update.html]
Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page.
[JVN#41875357]
[JVNDB-2016-000038]
The management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22 and earlier allows remote attackers to conduct clickjacking attacks via unspecified vectors.
[JVN#28480773]
[JVNDB-2016-000037]
[https://service.falconsc.com/]
The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to obtain or modify sensitive data via unspecified vectors.
[JVN#03975805]
[JVNDB-2016-000047]
[https://developer.a-blogcms.jp/blog/patch/entry-2363.html]
Cross-site scripting (XSS) vulnerability in the standard template of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML.
[JVN#73166466]
[JVNDB-2016-000046]
[https://developer.a-blogcms.jp/blog/patch/entry-2363.html]
Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#78482127]
[JVNDB-2016-000048]
[http://www.cyber-will.co.jp/SA_JVN_78482127]
[https://www.ec-cube.net/products/detail.php?product_id=799]
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
[JVN#03188560]
[JVNDB-2016-000096]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[91068]
[91787]
[1036056]
[https://bugzilla.redhat.com/show_bug.cgi?id=1343538]
[https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8]
[https://security.netapp.com/advisory/ntap-20180629-0006/]
[https://security-tracker.debian.org/tracker/CVE-2016-1181]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
[JVN#65044642]
[JVNDB-2016-000097]
[http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html]
[http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html]
[91067]
[91787]
[1036056]
[https://bugzilla.redhat.com/show_bug.cgi?id=1343540]
[https://github.com/kawasima/struts1-forever/commit/eda3a79907ed8fcb0387a0496d0cb14332f250e8]
[https://security.netapp.com/advisory/ntap-20180629-0006/]
[https://security-tracker.debian.org/tracker/CVE-2016-1182]
[https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html]
[https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
[https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html]
NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
[JVN#74659077]
[JVNDB-2016-000098]
[http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183]
Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
[JVN#00272277]
[JVNDB-2016-000049]
[http://www.tokyostarbank.co.jp/important151222.html]
The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application.
[JVN#89026267]
[JVNDB-2016-000055]
[96842]
[https://support.cybozu.com/ja-jp/article/9479]
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
[JVN#91816422]
[JVNDB-2016-000056]
[97976]
[https://support.cybozu.com/ja-jp/article/9480]
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
[JVN#11994518]
[JVNDB-2016-000060]
[https://support.cybozu.com/ja-jp/article/9446]
[https://support.cybozu.com/ja-jp/article/9495]
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors.
[JVN#18975349]
[JVNDB-2016-000077]
[https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03]
[https://support.cybozu.com/ja-jp/article/8845]
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
[JVN#18975349]
[JVNDB-2016-000093]
[https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03]
[https://support.cybozu.com/ja-jp/article/9020]
Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors.
[JVN#18975349]
[JVNDB-2016-000094]
[https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03]
[https://support.cybozu.com/ja-jp/article/8877]
Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
[JVN#14749391]
[JVNDB-2016-000078]
[https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03]
Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.
[JVN#14749391]
[JVNDB-2016-000095]
[https://garoon.cybozu.co.jp/support/update/package/421sp1.html#03]
Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.
[JVN#25765762]
[JVNDB-2016-000079]
[https://support.cybozu.com/ja-jp/article/8919]
Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
[JVN#26298347]
[JVNDB-2016-000080]
[https://support.cybozu.com/ja-jp/article/8983]
Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
<a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>
[JVN#32218514]
[JVNDB-2016-000081]
[https://support.cybozu.com/ja-jp/article/8987]
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.
[JVN#33879831]
[JVNDB-2016-000082]
[https://support.cybozu.com/ja-jp/article/8970]
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.
[JVN#37121456]
[JVNDB-2016-000083]
[https://support.cybozu.com/ja-jp/article/9303]
Photopt for Android before 2.0.1 does not verify SSL certificates.
[JVN#11815655]
[JVNDB-2016-000050]
[https://mypocket.ntt.com/photopt/info/info_001.html]
The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.
[JVN#47473944]
[JVNDB-2016-000051]
[http://www.ec-cube.net/info/weakness/weakness.php?id=65]
[https://www.ec-cube.net/info/weakness/201604/]
The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2016-1199.
[JVN#11458774]
[JVNDB-2016-000052]
[http://www.ec-cube.net/info/weakness/weakness.php?id=66]
[90503]
[https://www.ec-cube.net/info/weakness/201604/]
Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators.
[JVN#73776243]
[JVNDB-2016-000053]
[http://www.ec-cube.net/info/weakness/weakness.php?id=67]
[90515]
[https://www.ec-cube.net/info/weakness/201604/]
Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
<a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
[JVN#00324715]
[JVNDB-2016-000054]
[https://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d]
[https://github.com/electron/electron/pull/2976]
Cross-site scripting (XSS) vulnerability in the shiro8 (1) category_freearea_ addition_plugin plugin 1.0 and (2) itemdetail_freearea_ addition_plugin plugin 1.0 for EC-CUBE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#63384827]
[JVNDB-2016-000057]
[http://www.ec-cube.net/products/detail.php?product_id=505]
[88872]
The WPS implementation on I-O DATA DEVICE WN-GDN/R3, WN-GDN/R3-C, WN-GDN/R3-S, and WN-GDN/R3-U devices does not limit PIN guesses, which allows remote attackers to obtain network access via a brute-force attack.
[JVN#25674893]
[JVNDB-2016-000061]
[http://www.iodata.jp/support/information/2016/wn-gdnr3_bfa/]
Cross-site scripting (XSS) vulnerability on I-O DATA DEVICE WN-G300R devices with firmware 1.12 and earlier, WN-G300R2 devices with firmware 1.12 and earlier, and WN-G300R3 devices with firmware 1.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[JVN#22978346]
[JVNDB-2016-000062]
[http://www.iodata.jp/support/information/2016/wn-g300r_xss/]
The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.
[http://help.filemaker.com/app/answers/detail/a_id/15364]
[JVN#91638315]
[JVNDB-2016-000063]
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
[JVN#44657371]
[JVNDB-2016-000064]
[http://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html]
[http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities]
[http://www.rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload]
[https://ninjaforms.com/important-security-update-always-hurt-ones-love/]
[https://wordpress.org/plugins/ninja-forms/changelog/]
[https://wpvulndb.com/vulnerabilities/8485]
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
[JVN#11877654]
[JVNDB-2016-000065]
Cross-site scripting (XSS) vulnerability in Epoch Web Mailing List 0.31 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#43076390]
[JVNDB-2016-000066]
[http://www.psl.ne.jp/perl/ml/index.html]
Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
[JVN#42545812]
[JVNDB-2016-000069]
[http://www.futomi.com/library/info/2016/201605.html]
The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
[JVN#67266823]
[JVNDB-2016-000142]
[92596]
[https://support.cybozu.com/ja-jp/article/9221]
Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.
[JVN#67595539]
[JVNDB-2016-000143]
[92601]
[https://support.cybozu.com/ja-jp/article/9222]
Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.
[JVN#67595539]
[JVNDB-2016-000144]
[92601]
[https://support.cybozu.com/ja-jp/article/9223]
Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
[JVN#67595539]
[JVNDB-2016-000145]
[92601]
[https://support.cybozu.com/ja-jp/article/9223]
Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.
[JVN#67595539]
[JVNDB-2016-000146]
[92601]
[https://support.cybozu.com/ja-jp/article/9235]
SQL injection vulnerability in Cybozu Garoon before 4.2.2.
[JVN#83568336]
[JVNDB-2016-000147]
[92600]
[https://support.cybozu.com/ja-jp/article/9414]
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
[JVN#89211736]
[JVNDB-2016-000148]
[92598]
[https://support.cybozu.com/ja-jp/article/9408]
Cybozu Garoon before 4.2.2 does not properly restrict access.
[JVN#93411577]
[JVNDB-2016-000149]
[92599]
[https://support.cybozu.com/ja-jp/article/9407]
Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
[JVN#43529183]
[JVNDB-2016-000067]
Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
[JVN#85112513]
[JVNDB-2016-000070]
[http://www.kobe-beauty.co.jp/php-contact-form/]
[https://github.com/kobebeauty/php-contact-form/commit/e7d094ca8ab15215c32d6fa04d17e8519c8d21cf]
Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors.
[http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx]
[JVN#48847535]
[JVNDB-2016-000074]
CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.
[http://esupport.trendmicro.com/solution/ja-JP/1114102.aspx]
[JVN#48847535]
[JVNDB-2016-000089]
Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors.
[JVN#48789425]
[JVNDB-2016-000073]
[1036137]
[https://esupport.trendmicro.com/support/vb/solution/ja-jp/1113880.aspx]
Cross-site scripting (XSS) vulnerability in Trend Micro Internet Security 8 and 10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#48789425]
[JVNDB-2016-000088]
[1036137]
[https://esupport.trendmicro.com/support/vb/solution/ja-jp/1113880.aspx]
NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
[JVN#77403442]
[JVNDB-2016-000105]
[http://web116.jp/ced/support/news/contents/2016/20160627.html]
[http://www.ntt-west.co.jp/kiki/support/flets/hgw4_mi/160627.html]
Cross-site request forgery (CSRF) vulnerability on NTT EAST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1006 and earlier and NTT WEST Hikari Denwa routers with firmware PR-400MI, RT-400MI, and RV-440MI 07.00.1005 and earlier allows remote attackers to hijack the authentication of arbitrary users.
[JVN#45034304]
[JVNDB-2016-000106]
[http://web116.jp/ced/support/news/contents/2016/20160627.html]
[http://www.ntt-west.co.jp/kiki/support/flets/hgw4_mi/160627.html]
Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[JVN#56167268]
[JVNDB-2016-000068]
[https://github.com/humhub/humhub/releases/tag/v1.0.0-beta.3]
Cross-site scripting (XSS) vulnerability in NTT PC Communications WebARENA Service formmail before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#24143619]
[JVNDB-2016-000072]
[http://web.arena.ne.jp/support/news/2016/0208.html]
[http://web.arena.ne.jp/support/news/2016/0208_2.html]
[http://web.arena.ne.jp/support/suite1/manual/cgi_ssi/form.html]
Directory traversal vulnerability in the HTTP file-serving module (mod_http_files) in Prosody 0.9.x before 0.9.9 allows remote attackers to read arbitrary files via a .. (dot dot) in an unspecified path.
[http://blog.prosody.im/prosody-0-9-9-security-release/]
[FEDORA-2016-38e48069f8]
[FEDORA-2016-e289f41b76]
[DSA-3439]
[[oss-security] 20160108 CVE-2016-1231, CVE-2016-1232: Prosody XMPP server multiple vulnerabilities]
[https://prosody.im/issues/issue/520]
[https://prosody.im/security/advisory_20160108-1/]
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
<a href="https://cwe.mitre.org/data/definitions/338.html">CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)</a>
[http://blog.prosody.im/prosody-0-9-9-security-release/]
[FEDORA-2016-38e48069f8]
[FEDORA-2016-e289f41b76]
[DSA-3439]
[[oss-security] 20160108 CVE-2016-1231, CVE-2016-1232: Prosody XMPP server multiple vulnerabilities]
[https://prosody.im/issues/issue/571]
[https://prosody.im/security/advisory_20160108-2/]
An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable permissions for the /dev/cuse character device, which allows local users to gain privileges via a character device in /dev, related to an ioctl.
[DSA-3451]
Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.
[FEDORA-2016-68abc0be35]
[openSUSE-SU-2016:1527]
[openSUSE-SU-2016:1779]
[[oss-security] 20160307 CVE-2016-1234 in glibc glob with GLOB_ALTDIRFUNC]
[84204]
[GLSA-201702-11]
[https://sourceware.org/bugzilla/show_bug.cgi?id=19779]
[https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea]
The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors related to OpenSSH options.
[http://oar.imag.fr/oar_2.5.7]
[DSA-3543]
[https://raw.githubusercontent.com/oar-team/oar/ce77ffed620fdce94881c9b35064507777c24a1c/debian/patches/004-fix-oarsh-security-issue]
Multiple cross-site scripting (XSS) vulnerabilities in (1) revision.php, (2) log.php, (3) listing.php, and (4) comp.php in WebSVN allow context-dependent attackers to inject arbitrary web script or HTML via the name of a (a) file or (b) directory in a repository.
[DSA-3572]
[[oss-security] 20160506 CVE-2016-1236 - XSS Vulnerability in websvn 2.3.3-1.2+deb8u1]
[https://bugzilla.redhat.com/show_bug.cgi?id=1333673]
nfsd in the Linux kernel through 4.6.3 allows local users to bypass intended file-permission restrictions by setting a POSIX ACL, related to nfs2acl.c, nfs3acl.c, and nfs4acl.c.
[http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=999653786df6954a31044528ac3f7a5dadca08f4]
[DSA-3607]
[[oss-security] 20160625 Linux CVE-2016-1237: nfsd: any user can set a file's ACL over NFS and grant access to it]
[91456]
[USN-3053-1]
[USN-3070-1]
[USN-3070-2]
[USN-3070-3]
[USN-3070-4]
[https://bugzilla.redhat.com/show_bug.cgi?id=1350845]
[https://github.com/torvalds/linux/commit/999653786df6954a31044528ac3f7a5dadca08f4]
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
[openSUSE-SU-2019:1831]
[http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab]
[DSA-3628]
[[perl.perl5.porters] 20160725 CVE-2016-1238: Important unsafe module load path flaw]
[92136]
[1036440]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731]
[[announce] 20180916 [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781]
[[debian-lts-announce] 20181113 [SECURITY] [DLA 1578-1] spamassassin security update]
[FEDORA-2016-e9e5c081d4]
[FEDORA-2016-dd20a4631a]
[FEDORA-2016-6ec2009080]
[https://rt.perl.org/Public/Bug/Display.html?id=127834]
[GLSA-201701-75]
[GLSA-201812-07]
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
[http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html]
[RHSA-2017:0457]
[DSA-3669]
[DSA-3670]
[20161001 CVE-2016-1240 - Tomcat packaging on Debian-based distros - Local Root Privilege Escalation]
[93263]
[1036845]
[USN-3081-1]
[RHSA-2017:0455]
[RHSA-2017:0456]
[GLSA-201705-09]
[https://security.netapp.com/advisory/ntap-20180731-0002/]
[40450]
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.
[DSA-3656]
[http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html]
[https://bugs.tryton.org/issue5795]
file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.
[DSA-3656]
[http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.html]
[https://bugs.tryton.org/issue5808]
Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname.
[http://tmp.tjjr.fi/0001-Fix-unsafe-extraction-by-using-mkdir-instead-of-shel.patch]
[DSA-3676]
[93329]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248]
[GLSA-201804-20]
The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.
[http://tmp.tjjr.fi/0001-Fix-unsafe-extraction-by-using-mkdir-instead-of-shel.patch]
[DSA-3676]
[93332]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248]
[GLSA-201804-20]
It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
[RHSA-2017:0794]
[http://www.gossamer-threads.com/lists/quagga/users/31952]
[93775]
[https://bugzilla.redhat.com/show_bug.cgi?id=1386109]
[https://github.com/Quagga/quagga/commit/cfb1fae25f8c092e0d17073eaf7bd428ce1cd546]
[GLSA-201701-48]
[DSA-3695]
Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
[http://blogs.perl.org/users/mike_b/2016/10/security-release---buffer-overflow-in-dbdmysql-perl-library.html]
[DSA-3684]
[93337]
[https://github.com/perl5-dbi/DBD-mysql/commit/7c164a0c86cec6ee95df1d141e67b0e85dfdefd2]
[GLSA-201701-51]
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
[http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html]
[20161116 Nginx (Debian-based distros) - Root Privilege Escalation Vulnerability (CVE-2016-1247)]
[20170113 Nginx (Debian-based + Gentoo distros) - Root Privilege Escalation [CVE-2016-1247 UPDATE]]
[DSA-3701]
[20161121 Nginx (Debian-based distros) - Root Privilege Escalation (CVE-2016-1247)]
[93903]
[1037104]
[USN-3114-1]
[https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html]
[GLSA-201701-22]
[40768]
[https://www.youtube.com/watch?v=aTswN1k1fQs]
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
[http://openwall.com/lists/oss-security/2016/11/22/20]
[RHSA-2016:2972]
[DSA-3722]
[94478]
[1037338]
[USN-3139-1]
[https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelog]
[https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040]
[https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a]
[https://github.com/vim/vim/releases/tag/v8.0.0056]
[[debian-lts-announce] 20161122 [SECURITY] [DLA 718-1] vim security update]
[https://lists.debian.org/debian-security-announce/2016/msg00305.html]
[GLSA-201701-29]
The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression.
[http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes]
[[oss-security] 20161115 CVE-2016-1249: Out-of-bounds read by DBD::mysql >= version 2.9003]
[94350]
[https://github.com/perl5-dbi/DBD-mysql/commit/793b72b1a0baa5070adacaac0e12fd995a6fbabe]
[GLSA-201701-51]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
[http://www.openwall.com/lists/oss-security/2016/11/28/2]
[94573]
[https://anonscm.debian.org/cgit/pkg-perl/packages/libdbd-mysql-perl.git/commit/?id=a8b97e4713391b1f8beffbfddac483c276feaff1]
[https://github.com/perl5-dbi/DBD-mysql/commit/3619c170461a3107a258d1fd2d00ed4832adb1b1]
[GLSA-201701-51]
[https://tracker.debian.org/news/819888]
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
[http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html]
[USN-3156-1]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1020]
[https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467]
[DSA-3733]
[40916]
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.
[[oss-security] 20161214 CVE-2016-1253 most: shell command injection through filenames]
[94931]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132]
[[debian-lts-announce] 20161216 [SECURITY] [DLA 745-1] most security update]
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
[openSUSE-SU-2016:3281]
[openSUSE-SU-2016:3282]
[https://blog.torproject.org/blog/tor-02812-released]
[https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd]
[FEDORA-2016-76b646637e]
[FEDORA-2016-95b4e9077e]
[https://trac.torproject.org/projects/tor/ticket/21018]
[DSA-3741]
The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in Ubuntu 12.04 LTS before 129ubuntu1.2, in Ubuntu 14.04 LTS before 154ubuntu1.1, in Ubuntu 16.04 LTS before 173ubuntu0.1, in Ubuntu 17.04 before 179ubuntu0.1, and in Ubuntu 17.10 before 184ubuntu1.1 allows local users to gain root privileges via a symlink attack on a logfile in /var/log/postgresql.
[USN-3476-1]
[USN-3476-2]
[https://anonscm.debian.org/cgit/pkg-postgresql/postgresql-common.git/commit/?id=c8989206ec360f199400c74f129f7b4cb878c1ee]
[[debian-lts-announce] 20170101 [SECURITY] [DLA-774-1] postgresql-common security update]
Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R7, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D18 or 14.1X53-D30, 14.1X55 before 14.1X55-D25, 14.2 before 14.2R4, 15.1 before 15.1R2, and 15.1X49 before 15.1X49-D10 allow remote attackers to cause a denial of service via a malformed IGMPv3 packet, aka a "multicast denial of service."
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10714]
[1035107]
The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 before 14.1R6, 14.1R3 before 14.1R3-S9, 14.1R4 before 14.1R4-S7, 14.1X51 before 14.1X51-D65, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D28, 14.1X53 before 4.1X53-D35, 14.2R1 before 14.2R5, 14.2R3 before 14.2R3-S4, 14.2R4 before 14.2R4-S1, 15.1 before 15.1R3, 15.1F2 before 15.1F2-S2, and 15.1X49 before 15.1X49-D40, when LDP is enabled, allows remote attackers to cause a denial of service (RPD routing process crash) via a crafted LDP packet.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10715]
[1035117]
Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10720]
[1035116]
Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to cause a denial of service (network loop and bandwidth consumption) via unspecified vectors related to Spanning Tree Protocol (STP) traffic.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10719]
[1035106]
J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS).
[https://kb.juniper.net/JSA10723]
Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49-D30 on SRX series devices, when the Real Time Streaming Protocol Application Layer Gateway (RTSP ALG) is enabled, allow remote attackers to cause a denial of service (flowd crash) via a crafted RTSP packet.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10721]
[1035108]
Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10758]
[1036304]
Race condition in the Op command in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 12.3X50 before 12.3X50-D50, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D39, 13.2X52 before 13.2X52-D30, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R4, 15.1 before 15.1F2 or 15.1R2, 15.1X49 before 15.1X49-D10 or 15.1X49-D20, and 16.1 before 16.1R1 allows remote authenticated users to gain privileges via the URL option.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10725]
[1035669]
A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.
[https://kb.juniper.net/JSA10727]
Race condition in the RPC functionality in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R3-S4, 15.1 before 15.1F2, or 15.1R2, 15.1X49 before 15.1X49-D20, and 16.1 before 16.1R1 allows local users to read, delete, or modify arbitrary files via unspecified vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10730]
[1035668]
The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10732]
[1035666]
Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R9, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R8, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R4-S1, 15.1 before 15.1R2, 15.1X49 before 15.1X49-D30, and 16.1 before 16.1R1 allow remote attackers to cause a denial of service (socket consumption) via crafted TCP timestamps.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10736]
The rpd daemon in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10737]
Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D25, 13.2 before 13.2R8, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.2 before 14.2R4, 15.1 before 15.1R1 or 15.1F2, and 15.1X49 before 15.1X49-D15 allow local users to gain privileges via crafted combinations of CLI commands and arguments, a different vulnerability than CVE-2015-3003, CVE-2014-3816, and CVE-2014-0615.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10739]
[1035667]
Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10746]
Juniper Junos OS 14.1X53 before 14.1X53-D30 on QFX Series switches allows remote attackers to cause a denial of service (PFE panic) via a high rate of unspecified VXLAN packets.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10747]
Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain sensitive mbuf information by injecting a flood of Ethernet frames with IPv6 MAC addresses directly into a connected interface.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10750]
[91758]
[1036301]
Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D23, 12.3X48 before 12.3X48-D25, and 15.1X49 before 15.1X49-D40 on a High-End SRX-Series chassis system with one or more Application Layer Gateways (ALGs) enabled allow remote attackers to cause a denial of service (CPU consumption, fab link failure, or flip-flop failovers) via vectors related to in-transit traffic matching ALG rules.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10751]
[91764]
[1036305]
Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D40, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R6, 15.1 before 15.1F6 or 15.1R3, and 15.1X49 before 15.1X49-D40, when configured with a GRE or IPIP tunnel, allow remote attackers to cause a denial of service (kernel panic) via a crafted ICMP packet.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10752]
[91755]
[1036306]
Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request system software" command with the "partition" option.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753]
[91757]
[1036307]
J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13.3R9 before 13.3R9-S1, 14.1 before 14.1R7, 14.1X53 before 14.1X53-D35, 14.2 before 14.2R6, 15.1 before 15.1A2 or 15.1F4, 15.1X49 before 15.1X49-D30, and 15.1R before 15.1R3 might allow remote attackers to obtain sensitive information and consequently gain administrative privileges via unspecified vectors.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10754]
[91759]
[1036302]
PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R7, 15.1 before 15.1R4, 15.1X49 before 15.1X49-D20, 15.1X53 before 15.1X53-D60, and 16.1 before 16.1R1 allow remote attackers to bypass an intended certificate validation mechanism via a self-signed certificate with an Issuer name that matches a valid CA certificate enrolled in Junos.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10755]
[91761]
[1036303]
Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application directory", as demonstrated with the USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll DLLs.
[20160108 Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege]
[[oss-security] 20160111 CVE-2016-1281: TrueCrypt and VeraCrypt Windows installers allow arbitrary code execution with elevation of privilege]
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
[FEDORA-2016-65833b5dbc]
[FEDORA-2016-f5af8e27ce]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[79825]
[1034555]
[SSA:2016-172-02]
[RHSA-2016:1132]
[https://bto.bluecoat.com/security-advisory/sa128]
[https://bugs.exim.org/show_bug.cgi?id=1767]
[GLSA-201607-02]
[https://www.tenable.com/security/tns-2016-18]
[https://www.tenable.com/security/tns-2017-14]
rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via crafted flag values in a query.
[1034935]
[https://kb.isc.org/article/AA-01348]
[https://kb.isc.org/article/AA-01438]
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
[FEDORA-2016-364c0a9df4]
[FEDORA-2016-161b73fc2c]
[FEDORA-2016-b593e84223]
[FEDORA-2016-5047abe4a9]
[FEDORA-2016-75f31fbb0a]
[FEDORA-2016-dce6dbe6a8]
[SUSE-SU-2016:0759]
[SUSE-SU-2016:0780]
[SUSE-SU-2016:0825]
[openSUSE-SU-2016:0827]
[openSUSE-SU-2016:0830]
[openSUSE-SU-2016:0834]
[openSUSE-SU-2016:0859]
[SUSE-SU-2016:1541]
[SSRT110084]
[RHSA-2016:0562]
[RHSA-2016:0601]
[DSA-3511]
[http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[1035236]
[USN-2925-1]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821]
[https://kb.isc.org/article/AA-01352]
[https://kb.isc.org/article/AA-01380]
[https://kb.isc.org/article/AA-01438]
[FreeBSD-SA-16:13]
[GLSA-201610-07]
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
[FEDORA-2016-364c0a9df4]
[FEDORA-2016-161b73fc2c]
[FEDORA-2016-b593e84223]
[FEDORA-2016-5047abe4a9]
[FEDORA-2016-75f31fbb0a]
[FEDORA-2016-dce6dbe6a8]
[SUSE-SU-2016:0759]
[SUSE-SU-2016:0780]
[SUSE-SU-2016:0825]
[openSUSE-SU-2016:0827]
[openSUSE-SU-2016:0830]
[openSUSE-SU-2016:0834]
[openSUSE-SU-2016:0859]
[SUSE-SU-2016:1541]
[SSRT110084]
[RHSA-2016:0562]
[RHSA-2016:0601]
[DSA-3511]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[1035237]
[USN-2925-1]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05087821]
[https://kb.isc.org/article/AA-01353]
[https://kb.isc.org/article/AA-01380]
[https://kb.isc.org/article/AA-01438]
[FreeBSD-SA-16:13]
[GLSA-201610-07]
Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.
[http://packetstormsecurity.com/files/137100/Cisco-ASA-Software-IKEv1-IKEv2-Buffer-Overflow.html]
[20160210 Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability]
[1034997]
[https://blog.exodusintel.com/2016/02/10/firewall-hacking/]
[39823]
[VU#327976]
The HTTPS Proxy feature in Cisco AsyncOS before 8.5.3-051 and 9.x before 9.0.0-485 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (service outage) by leveraging certain intranet connectivity and sending a malformed HTTPS request, aka Bug ID CSCuu24840.
[20160302 Cisco Web Security Appliance HTTPS Packet Processing Denial of Service Vulnerability]
[1035163]
The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device credentials, aka Bug ID CSCuy10231.
[20160629 Cisco Prime Infrastructure and Evolved Programmable Network Manager Authentication Bypass API Vulnerability]
[91504]
[1036195]
The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka Bug ID CSCuy10227.
[20160406 Cisco Prime Infrastructure and Evolved Programmable Network Manager Privilege Escalation API Vulnerability]
[1035498]
Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.
[20160406 Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability]
[1035497]
[https://blogs.securiteam.com/index.php/archives/2727]
Multiple cross-site scripting (XSS) vulnerabilities in the Management Center in Cisco FireSIGHT System Software 6.0.0 and 6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCux40414.
[20160115 Cisco FireSIGHT Management Center Stored Cross-Site Scripting Vulnerabilities]
[1034689]
Cross-site scripting (XSS) vulnerability in the Management Center in Cisco FireSIGHT System Software 6.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted cookie, aka Bug ID CSCuw89094.
[20160115 Cisco FireSIGHT Management Center DOM-Based Cross-Site Scripting Vulnerability]
[1034690]
Cisco Adaptive Security Appliance (ASA) Software 8.4 allows remote attackers to obtain sensitive information via an AnyConnect authentication attempt, aka Bug ID CSCuo65775.
[20160115 Cisco Adaptive Security Appliance Information Disclosure Vulnerability]
[1034691]
The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to bypass intended proxy restrictions via a malformed HTTP method, aka Bug ID CSCux00848.
[20160119 Cisco Web Security Appliance Security Bypass Vulnerability]
[1034763]
The Device Manager GUI in Cisco Application Control Engine (ACE) 4710 A5 before A5(3.1) allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801.
[20160224 Cisco ACE 4710 Application Control Engine Command Injection Vulnerability]
[1035104]
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033.
[20160125 Cisco Unified Contact Center Express Cross-Site Scripting Vulnerability]
[1034828]
The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service (HTTPS outage) via crafted HTTPS requests, aka Bug ID CSCuw87174.
[20160127 Cisco Small Business SG300 Managed Switch Web Framework GUI Function Denial of Service Vulnerability]
Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux82582.
[20160127 Cisco Unity Connection Web Framework Cross-Site Scripting Vulnerability]
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112) allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842.
[20160203 Cisco ASA-CX and Cisco Prime Security Manager Privilege Escalation Vulnerability]
[1034926]
[1034927]
Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow remote authenticated users to bypass intended RBAC restrictions via crafted REST requests, aka Bug ID CSCut12998.
[20160203 Cisco Application Policy Infrastructure Controller Access Control Vulnerability]
[1034925]
The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330.
[20160128 Cisco Small Business 500 Series Switches Denial of Service Vulnerability]
Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux82596.
[20160128 Cisco Unity Connection User Search Cross-Site Scripting Vulnerability]
[1034868]
Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities, aka Bug ID CSCux15511.
[20160201 Cisco Application Policy Infrastructure Controller Enterprise Module Cross-Site Scripting Vulnerability]
[1034902]
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Fog Director 1.0(0) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux80466.
[20160201 Cisco Fog Director Cross-Site Scripting Vulnerability]
The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085.
[20160202 Cisco Finesse Desktop and Cisco Unified Contact Center Express Applications XMPP Unauthorized Access Vulnerability]
[1034920]
[1034921]
SQL injection vulnerability in Cisco Unified Communications Manager 10.5(2.13900.9) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCux99227.
[20160203 Cisco Unified Communications Manager SQL Injection Vulnerability]
[1034938]
Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meetings Server 2.5.1.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy01843.
[20160202 Cisco WebEx Meetings Server Multiple Cross-Site Scripting Vulnerabilities]
[1034919]
Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 11.5(0.199) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy09033.
[20160203 Cisco Unity Connection Web Framework Cross-Site Scripting Vulnerability]
[1034937]
Cross-site scripting (XSS) vulnerability in the management interface in Cisco Jabber Guest Server 10.6(8) allows remote attackers to inject arbitrary web script or HTML via the host tag parameter, aka Bug ID CSCuy08224.
[20160203 Cisco Jabber Guest Server HTTP Web-Based Management Interface Cross-Site Scripting Vulnerability]
[1034936]
The HTTPS inspection engine in the Content Security and Control Security Services Module (CSC-SSM) 6.6 before 6.6.1164.0 for Cisco ASA 5500 devices allows remote attackers to cause a denial of service (memory consumption or device reload) via a flood of HTTPS packets, aka Bug ID CSCue76147.
[84281]
[1035230]
[20160309 Cisco ASA Content Security and Control Security Services Module Denial of Service Vulnerability]
Cisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance, and Whiptail Racerunner improperly store a default SSH private key, which allows remote attackers to obtain root access via unspecified vectors, aka Bug ID CSCun71294.
[20160406 Cisco UCS Invicta Default SSH Key Vulnerability]
[1035496]
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (CDM) 8.1(1) allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux80760.
[20160328 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability]
[1035425]
The proxy engine in Cisco Advanced Malware Protection (AMP), when used with Email Security Appliance (ESA) 9.5.0-201, 9.6.0-051, and 9.7.0-125, allows remote attackers to bypass intended content restrictions via a malformed e-mail message containing an encoded file, aka Bug ID CSCux45338.
[20160211 Cisco Advanced Malware Protection and Email Security Appliance Proxy Engine Security Bypass Vulnerability]
[1035008]
Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive call-statistics information via a direct request to an unspecified URL, aka Bug ID CSCux73362.
[20160208 Cisco Video Communications Server Information Disclosure Vulnerability]
[1034956]