openSUSE Security Update : sqlite3 (openSUSE-2016-970)

This update for sqlite3 fixes the following issues : The following security issue was fixed : - CVE-2016-6153: Fixed a tempdir selection vulnerability bsc987394 This update was imported from the SUSE:SLE-12-SP1:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...

FreePBX 13/14 - Remote Command Execution / Privilege Escalation

!/usr/bin/env python -- coding, latin-1 -- DESCRIPTION FreePBX 13 remote root 0day - Found and exploited by pgt @ nullsecurity.net AUTHOR pgt - nullsecurity.net DATE 8-12-2016 VERSION freepbx0day.py 0.1 AFFECTED VERSIONS FreePBX 13 & 14 System Recordings Module versions: 13.0.1beta1 - 13.0.26...

Teamspeak 3 Use-After-Free / Information Disclosure / DoS

Teamspeak 3 RCE advisory by: ff214370685e536b9ee021c7ff6b7680bfbe6008bc29f87511b6b90256043536 August 10, 2016 While auditing the Teamspeak 3 server I've discovered several 0-day vulnerabilities which I'll describe in detail in this advisory. They exist in the newest version of the server, version...

net2ftp 1.0 Cross Site Scripting

Summary Subject: net2ftp XSS in "command" and "urlwithpw" parameters Versions vulnerable: ALL Tested on latest, version 1.0 Category: 0-day Impact: Medium Description of the product net2ftp is a web based FTP client http://www.net2ftp.com/index.php . It can be used as a standalone version and als...

K2 Joomla! Extension Cross Site Scripting

================================================================ K2 Joomla! Extension PoC: http://localhost/administrator/index.php?option=comk2&view=categori...

Debian DLA-581-1 : libreoffice security update

Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u7. We recommend that you upgrade yo...

Debian DSA-3632-1 : mariadb-10.0 - security update

Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.26. Please see the MariaDB 10.0 Release Notes for further details : - https://mariadb.com/kb/en/mariadb/mariadb-10026-release- notes/...

CVE-2016-4974

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...

CVE-2016-4974

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the libstdc++6-0 package of the Debian GNU/Linux operating system may lead to a violation of the integrity of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the libstdc++6-0-dev package of the Debian GNU/Linux operating system may lead to a violation of the integrity of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the libstdc++6-0-dbg package of the Debian GNU/Linux operating system may lead to a violation of the integrity of protected information. These vulnerabilities can be exploited remotely...

GE Proficy HMI/SCADA CIMPLICITY 8.2 - Privilege Escalation

Exploit for windows platform in category local exploits / Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit0 day Vulnerability Discovery and Exploit Author: Zhou Yu Email: Version: 8.2 Tested on: Windows 7 SP1 X32 CVE : None Vulnerability Description:...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The multiple vulnerabilities in the libstdc++6-0-pic package of the Debian GNU/Linux operating system may lead to a violation of the integrity of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Debian GNU/Linux operating system that allow a local malicious individual to compromise the accessibility of protected information

The multiple vulnerabilities in the libgtk2.0-0-dbg package of the Debian GNU/Linux operating system can be exploited, leading to a violation of the accessibility of protected information. These vulnerabilities can be exploited by local malicious individuals...

ImageMagick 7.x < 7.0.2-0 ReadSUNImage() Function SUN Image Handling DoS

The remote Windows host has a version of ImageMagick installed that is 7.x prior to 7.0.2-0. It is, therefore, affected by a denial of service vulnerability due to a flaw in the ReadSUNImage function in sun.c that is triggered during the handling of malformed SUN images. An unauthenticated, remot...

PKAV found Struts2 latest remote command execution vulnerability S2-0 3 7-the vulnerability warning-the black bar safety net

0x00 Preface Just after children's Day back found that struts2 shows the S033, so put down the hands of the Lollipop quickly analyze. ! 0x01 S2-0 3 3 vulnerability review First recall S033 According to the official description ! Obviously there are two key points: the first is the REST Plugin,the...

Cloud computing a core component of QEMU even explosion 1 0 pieces of high-risk vulnerabilities-vulnerability warning-the black bar safety net

Since 5 month so far,as cloud computing is an important underlying component of QEMU has been a continuous burst of 1 0 pieces of high-risk vulnerabilities,from the official website of the vulnerability Description,This 1 0 piece vulnerability, respectively, will cause comprises a“virtual machine...

Debian Security Advisory DSA 3595-1 (mariadb-10.0 - security update)

Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.25. Please see the MariaDB 10.0 Release Notes for further details: https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/...