Debian DSA-3949-1 : augeas - security update

Han Han of Red Hat discovered that augeas, a configuration editing tool, improperly handled some escaped strings. A remote attacker could leverage this flaw by sending maliciously crafted strings, thus causing an augeas-enabled application to crash or potentially execute arbitrary code...

CVE-2016-3949

Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and Profinet-disabled CPU devices with firmware before 3.3.12 are vulnerable to remote denial of service (defect-mode transition) via crafted ISO-TSAP or Profibus packets. Exploitation details and explicit remediation...

Siemens SIMATIC S7-300 DoS Vulnerability (SSA-818183)

Siemens SIMATIC S7-300 devices are prone to a denial of service DoS vulnerability. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Threat Outbreak Alert RuleID20208: Email Messages Distributing Malicious Software on December 20, 2015

Medium Alert ID: 42801 First Published: 2015 December 21 15:26 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20208 may contain the following files: Name |...

CVE-2015-3949

The CVE-2015-3949 issue affects Sinapsi eSolar Light firmware prior to 2.0.3970_schsl_2.2.85. Vulnerability: a plaintext password disclosure via viewing the HTML source on the mail-configuration page. Impact: attacker with local access can read cleartext passwords stored for mail configuration, c...

CVE-2015-3949

Sinapsi eSolar Light with firmware before 2.0.3970schsl2.2.85 allows attackers to discover cleartext passwords by reading the HTML source code of the mail-configuration page...

Sinapsi eSolar Light Plaintext Passwords Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified plain text passwords in Sinapsi’s eSolar Light application. Sinapsi has produced a new version to mitigate this vulnerability. AFFECTED PRODUCTS The following Sinapsi eSolar Light versions are affected: Sinapsi eSolar Light firmware versio...

Joomla Component com_artlinks Remote File Inclusion (CVE-2006-3949)

A file inclusion vulnerability has been reported in Mambo ComArtlinks Component. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2014-3949

Cross-site scripting XSS vulnerability in the layout wizard in the Grid Elements gridelements extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3949

CVE-2014-3949 describes a cross-site scripting (XSS) vulnerability in the Grid Elements (gridelements) TYPO3 extension. The issue affects the layout wizard in versions before 1.5.1 and 2.0.x before 2.0.3, allowing a remote authenticated backend user to inject arbitrary script or HTML via unspecif...

Cross-Site Scripting in gridelements

It has been discovered that the extension "Grid Elements" gridelements is susceptible to Cross-Site Scripting Release Date: May 27, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.2 and below, 1.5.0 and below...

CVE-2011-3949

CVE-2011-3949 affects FFmpeg: the dirac_unpack_idwt_params function in libavcodec/diracdec.c (FFmpeg prior to 0.10) can be triggered by crafted Dirac data to cause an unspecified impact. The connected advisories reiterate the exact description and note that remediation involves upgrading FFmpeg. ...

CVE-2011-3949

The diracunpackidwtparams function in libavcodec/diracdec.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Dirac data...

CVE-2013-3949

The CVE-2013-3949 entry concerns the XNU kernel used in Apple Mac OS X 10.8.x. The issue arises in the posix_spawn system call, which does not prevent the use of _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid/setgid programs. This enables local users to bypass intende...

CVE-2013-3949

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

CVE-2012-3949

CVE-2012-3949 affects Cisco CUCM SIP stack and related Cisco IOS/IOS XE releases. A crafted SIP message containing an SDP session description could cause a denial of service (service crash or device reload) in CUCM 6.x/7.x (before 7.1(5b)su5), CUCM 8.x (before 8.5(1)su4), CUCM 8.6 (before 8.6(2a)...

Secunia Research: Microsoft Office TIFF Image Converter Endian Conversion Vulnerability

====================================================================== Secunia Research 14/12/2010 - Microsoft Office TIFF Image Converter - - Endian Conversion Vulnerability - ====================================================================== Table of Contents Affected...

CVE-2010-3949

CVE-2010-3949 affects Microsoft Office XP SP3 and the Office Converter Pack, via a buffer overflow in the TIFF Image Converter (TIFFIM32.FLT) used by the graphics filters. The vulnerability arises when converting TIFF data endianness, allowing a crafted TIFF image in an Office document to trigger...

CVE-2009-3949

cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remote attackers to create administrative accounts via the name, password, and confpassword parameters...

CVE-2009-3949

CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier (cp/profile.php). The root cause is missing administrative authentication for the donewauthor action, allowing remote attackers to create administrative accounts via the name, password, and conf_password parameters. Exploitation is net...