Debian Security Advisory DSA 3525-1 (pixman - security update)

Vincent LE GARREC discovered an integer overflow in pixman, a pixel-manipulation library for X and cairo. A remote attacker can exploit this flaw to cause an application using the pixman library to crash, or potentially, to execute arbitrary code with the privileges of the user running the...

Fedora Update for webkitgtk3 FEDORA-2016-1

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 23 : webkitgtk3-2.4.10-1.fc23 (2016-1a7f7ffb58)

This update addresses the following vulnerabilities : - CVE-2015-1120 https://vulners.com/cve/CVE-2015-1120 - CVE-2015-1076 https://vulners.com/cve/CVE-2015-1076 - CVE-2015-1071 https://vulners.com/cve/CVE-2015-1071 - CVE-2015-1081 https://vulners.com/cve/CVE-2015-1081 - CVE-2015-1122...

CVE-2014-9768

IBM Tivoli NetView Access Services NVAS allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls in the NVAS product...

CVE-2014-9768

IBM Tivoli NetView Access Services (NVAS) is affected by CVE-2014-9768, where remote authenticated users can gain privileges by issuing an ADM command and setting the page ID to the EMSPG2 transaction code. The vulnerability description across sources consistently notes that the vendor believes p...

GongDa vs. Korean News

On Jan. 27, we observed visitors to a Korean news site being redirected to the GongDa Exploit Kit EK, potentially exposing them to malware infection. We will be referring to this site as KNS. GongDa is an exploit kit that can compromise vulnerable endpoints by use of exploits, allowing harmful...

GongDa vs. Korean News

On Jan. 27, we observed visitors to a Korean news site being redirected to the GongDa Exploit Kit EK, potentially exposing them to malware infection. We will be referring to this site as KNS. GongDa is an exploit kit that can compromise vulnerable endpoints by use of exploits, allowing harmful...

Cisco UCS Manager GNU Bash Environment Variable Command Injection Vulnerability (cisco-sa-20140926-bash, Shellshock) - Active Check

On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is...

Cisco UCS Manager 2.1(1b) Shellshock

!/usr/bin/python Cisco UCS Manager 2.11b Shellshock Exploit CVE-2014-6278 Confirmed on version 2.11b, but more are likely vulnerable. Cisco's advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash Exploit generates a reverse shell to a nc listener...

SUSE-SU-2016:0786-1 Security update for sles12-docker-image

This update for sles12-docker-image fixes issues with binaries and libraries included in the image where security updates have been made available in the last weeks. glibc security issues fixed: - CVE-2015-7547: A stack-based buffer overflow in getaddrinfo allowed remote attackers to cause a cras...

Ubuntu: Security Advisory (USN-2933-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)

Cisco UCS Manager 2.11b - Remote Command Injection Shellshock !/usr/bin/python Cisco UCS Manager 2.11b Shellshock Exploit CVE-2014-6278 Confirmed on version 2.11b, but more are likely vulnerable. Cisco's advisory:...

Apache ActiveMQ Shutdown Command Denial of Service (CVE-2014-3576)

A denial of service vulnerability exists in Apache ActiveMQ. The vulnerability is due to missing authentication for the undocumented shutdown command. A remote, unauthenticated attacker may exploit this vulnerability by sending crafted packets to the server. Successful exploitation could lead to ...

Mallbuilder lostpass.php 文件 userid 参数SQL注入漏洞

0x01 漏洞概述 相关厂商： 上海远丰信息科技有限公司 官方主页： shop-builder.cn 提交时间： 2014-06-03 公开时间： 2014-09-01 漏洞类型： SQL注射漏洞 谷歌关键字： powered by mallbuilder 0x02 漏洞详情 首先来看看全局文件 function magic if!getmagicquotesgpc&&isset$POST foreach$POST as $key=$v if!isarray$v $POST$key=addslashes$v; else foreach$v as $skey=$sv if!isarray$...

Ubuntu 14.04 LTS : Exim vulnerabilities (USN-2933-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2933-1 advisory. It was discovered that Exim incorrectly filtered environment variables when used with the perlstartup configuration option. If the perlstartup option was...

Cisco UCS Manager 2.1(1b) - Remote Exploit (Shellshock)

Exploit for hardware platform in category remote exploits !/usr/bin/python Cisco UCS Manager 2.11b Shellshock Exploit CVE-2014-6278 Confirmed on version 2.11b, but more are likely vulnerable. Cisco's advisory:...

Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)

!/usr/bin/python Cisco UCS Manager 2.11b Shellshock Exploit CVE-2014-6278 Confirmed on version 2.11b, but more are likely vulnerable. Cisco's advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash Exploit generates a reverse shell to a nc listener...

Amazon Linux AMI : tomcat6 (ALAS-2016-656)

It was found that the expression language resolver evaluated expressions within a privileged code section. A malicious web application could use this flaw to bypass security manager protections. CVE-2014-7810 It was found that Tomcat would keep connections open after processing requests with a...

Amazon Linux AMI : tomcat8 (ALAS-2016-658)

A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application in a getResource, getResourceAsStream, or...

Amazon Linux AMI : tomcat7 (ALAS-2016-657)

A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application in a getResource, getResourceAsStream, or...