JVN#89613370: i-HTTPD vulnerable to cross-site scripting

i-HTTPD is a web server for Windows. i-HTTPD contains a flaw in generating a directory index page, which may lead to a cross-site scripting CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Do not use i-HTTPD i-HTTPD is no longer being developed or maintained...

JVN#16406395: "File Upload BBS" of i-HTTPD vulnerable to remote command execution

i-HTTPD is a web server for Windows, implementing Server Side Includes SSI. i-HTTPD contains "File Upload BBS". When "File Upload BBS" is activated, a user can upload files on the server, and i-HTTPD processes SSI directives in the uploaded files CWE-97. Impact An arbitrary command may be execute...

CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

Design/Logic Flaw

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

CVE-2014-8867

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O MMIO emulated in the hypervisor, which allows local HVM guests to cause a denial of service host crash via unspecified vectors...

CVE-2014-7842

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service guest OS crash via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to...

RHEL 6 : qemu-kvm-rhev, qemu-kvm-rhev-tools, qemu-img-rhev (RHSA-2013:1754)

Updated qemu-kvm-rhev, qemu-kvm-rhev-tools, and qemu-img-rhev packages are now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from...

i-FTP 2.20 - Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title:i-FTP Buffer Overflow SEH Homepage:http://www.memecode.com/iftp.php Software Link:www.memecode.com/data/iftp-win32-v220.exe Version:i.Ftp v2.20 Win32 Release Vulnerability discovered:26.10.2014 Description:Simple portable cross platform FTP/SFTP/HTTP client. Tested...

i-Ftp 2.20 Buffer Overflow

!/usr/bin/python Exploit Title:i-FTP Buffer Overflow SEH Homepage:http://www.memecode.com/iftp.php Software Link:www.memecode.com/data/iftp-win32-v220.exe Version:i.Ftp v2.20 Win32 Release Vulnerability discovered:26.10.2014 Description:Simple portable cross platform FTP/SFTP/HTTP client. Tested...

CVE-2014-7470

The CVE-2014-7470 entry concerns the I Know the Movie Android app (com.guilardi.jesaislefilm2), specifically jesais_film_android_1.1. The vulnerability is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and exfiltrate...

CVE-2014-7085

The i Newspaper aka com.independent.thei application @7F080184 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7085

The CVE-2014-7085 entry concerns the Android app i Newspaper (com.independent.thei, package @7F080184). The vulnerability is that it does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificat...

SEC Consult SA-20140710-3 :: Design Issue / Password Disclosure in WAGO-I/O-SYSTEM with CODESYS V2.3 WebVisu

SEC Consult Vulnerability Lab Security Advisory 20140710-3 ======================================================================= title: Design Issue / Password Disclosure product: All WAGO-I/O-SYSTEMs which provide a CODESYS V2.3 WebVisu vulnerable version: Systems which are programmable with =...

[SECURITY] Fedora 19 Update: squid-3.3.13-2.fc19

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DN...

EFF Launches New Anti-Surveillance Site

The EFF has launched a new site dedicated to educating users about how to resist pervasive surveillance online, through the promotion of encryption and other tools and the publication of first-person stories from people around the world who have fought surveillance in various ways. The new site, ...

[SECURITY] Fedora 20 Update: nodejs-0.10.32-1.fc20

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 19 Update: nodejs-0.10.32-1.fc19

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...