[security bulletin] HPSBGN03108 rev.1 - HP Records Manager, Remote Cross-Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04441391 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04441391 Version: 1 SUPPORT...

CVE-2014-6434

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

CVE-2014-6433

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

Information disclosure

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2014-6434

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

CVE-2014-6433

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2014-6433

CVE-2014-6433 concerns gpExec in the GoPro HERO 3+. The vulnerability arises from insufficient parameter validation for the a1/a2 parameters when the start action is invoked (c1/c2 set to start), enabling remote code execution. The primary publicly referenced detail is the ZDI advisory (ZDI-14-34...

CVE-2014-6434

The CVE-2014-6434 issue affects GoPro HERO 3+ via gpExec. The vulnerability arises from insufficient parameter validation on the a1/a2 parameters when c1/c2 are set to restart, enabling remote code execution. Impact is remote execution of arbitrary commands on vulnerable devices without authentic...

Asx To MP3 2.7.5 Stack Buffer Overflow

Exploit Title: ASX to MP3 Converter 2.7.5 stack buffer overflow Date: 6 Oct 2014 Exploit Author: Amir Reza Tavakolian Vendor Homepage: http://binarylife.blog.ir/ Software Link: http://download.cnet.com/ASX-to-MP3-Converter/3000-21684-10385919.html Version: 2.7.5 Tested on: windows xp sp 3 Special...

Threat Outbreak Alert RuleID11833: Email Messages Distributing Malicious Software on October 3, 2014

Medium Alert ID: 35936 First Published: 2014 October 3 14:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID11833 may contain the following files: Name |...

(0Day) GoPro HERO 3+ gpExec restart Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GoPro HERO 3+. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gpExec component. This component performs insufficient parameter validation on the...

(0Day) GoPro HERO 3+ gpExec start Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GoPro HERO 3+. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gpExec component. This component performs insufficient parameter validation on the...

Fedora 21 : nodejs-qs-0.6.6-3.fc21 (2014-11309)

The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash. More information:...

SUSE-SU-2015:0736-1 Security update for Linux kernel

The SUSE Linux Enterprise 11 Service Pack 3 kernel has been updated to fix various bugs and security issues. The following security bugs have been fixed: CVE-2014-1739: The mediadeviceenumentities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a...

[SECURITY] Fedora 19 Update: xerces-j2-2.11.0-15.fc19

Welcome to the future! Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface XNI, a complete framework f or building parser components and configurations that is extremely...

JDownloads

unauthorized file upload vulnerable versions: below 1.9.1.6 Joomla 2.5 and below 1.9.2.11 Joomla 3 security release announcement: http://www.jdownloads.com/index.php?option=comcontent=article=231:urgent-security-update-for-19-series=51:news Note that the developer did not inform the VEL...

[SECURITY] Fedora 21 Update: xerces-j2-2.11.0-22.fc21

Welcome to the future! Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface XNI, a complete framework f or building parser components and configurations that is extremely...

RHEL 7 : kernel (RHSA-2014:1281)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1281 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. An out-of-bounds memory access flaw was found in the Linux...

CVE-2014-7142

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service crash via a crafted 1 ICMP or 2 ICMP6 packet size...

CVE-2014-7141

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service out-of-bounds read and crash via a crafted type in an 1 ICMP or 2 ICMP6 packet...