Threat Outbreak Alert: Fake Account Statement Email Messages on April 3, 2014

Medium Alert ID: 33634 First Published: 2014 April 3 12:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a account statement for the recipient. The text in the email message attempts to convince the recipient to open t...

oVirt跨站请求伪造漏洞

CVE ID:CVE-2014-0152 oVirt是一个虚拟化平台，一个易于使用的Web界面。 由于程序允许用户通过未验证的HTTP请求执行某些操作，攻击者可以利用漏洞在一个登录的用户访问恶意网站时将请求发送到REST API或GWT RPC的servlet。 0 oVirt 3.x 目前没有详细解决方案： http://www.ovirt.org/Home...

Microsoft MPEG Layer-3 Audio Decoder Stack Overflow (MS10-026) - Ver2 (CVE-2010-0480)

MPEG Layer-3 audio codecs are the MPEG Layer-3 Audio Codec for Microsoft DirectShow l3codecx.ax and the Fraunhofer IIS MPEG Layer-3 ACM codecs L3codeca.acm and L3codecp.acm. These MPEG Layer-3 audio codecs are provided along with Windows Media files on affected versions of Microsoft Windows. A...

Vulnerability in contrib module (CVE-2014-0066)

Potential null pointer dereference crash when crypt3 returns NULL...

DSA-2888-1 ruby-actionpack-3.2 - security update

Bulletin has no description...

Puppet Enterprise 3.x < 3.1.3 LibYAML Heap-Based Buffer Overflow

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.3. As a result, it is reportedly affected by an error related to the included LibYAML version, the 'yamlparserscantaguri' function and YAML tag parsing that could allow a heap-based...

[SECURITY] Fedora 20 Update: catfish-1.0.1-1.fc20

Catfish is a handy file searching tool. The interface is intentionally lightweight and simple, using only GTK+3. You can configure it to your needs by using several command line options...

Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt27

3:11-alt27 built March 13, 2014 Sergey V Turchin in task 116326 --- March 13, 2014 Sergey V Turchin - new version - security fixes: CVE-2014-0503, CVE-2014-0504...

Backdoor found in Samsung Galaxy Devices, allows Hackers to remotely access/modify Data

Google’s Android operating system may be open source, but the version of Android that runs on most phones, tablets, and other devices includes proprietary, closed-source components. Phone makers, including Samsung ships its Smartphones with a modified version of Android, with some pre-installed...

CVE-2014-2318

SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter...

Sql injection

SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2014-2318

SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter...

CVE-2014-2318

The provided connections confirm CVE-2014-2318 is an SQL injection vulnerability in ATCOM Netvolution 3, exploitable via the m parameter to allow remote arbitrary SQL execution. Affected component is ATCOM Netvolution 3; root cause is improper input handling leading to SQL command injection. Impa...

XDA Forum hackers again proof Sony Xperia Z2 UI-bug warning-the black bar safety net

Recently a senior XDA developer Forum member in the online release of more than one Xperia Z2 real machine picture, and shows the phone running Android 4.3 system, using the new UI, the phone use is very unstable, the UI has been crashing. Today, the XDA member latest release of the Xperia Z2...

Threat Outbreak Alert: Fake Price Adjustment Notification Email Messages on March 3, 2014

Medium Alert ID: 33157 First Published: 2014 March 3 15:42 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a price change notice from the Bank of Italy for the recipient. The text in the email message...

Updated phpseclib and phpmyadmin packages fix security vulnerability

Cross-site scripting XSS vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action CVE-2014-1879. This upgrade provides the latest phpmyadmin version 4.1.8 to address this vulnerabilit...

Cisco Adaptive Security Appliance TFTP配置请求竞争条件漏洞

CVE ID:CVE-2014-0739 Cisco Adaptive Security Appliance是一款自适应安全设备，可提供安全和VPN服务的模块。 Cisco Adaptive Security Appliance处理配置电话代理连接数据库的TFTP请求存在竞争条件错误，允许攻击者利用漏洞操作部分配置数据。 0 Cisco Adaptive Security Appliance ASA 9.13 Cisco ASA 5500-X Series Adaptive Security Appliances 目前没有详细解决方案提供：...

Fedora 20 : gnutls-3.1.20-3.fc20 (2014-2580)

Fixed certificate verification issue CVE-2014-1959 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service

actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service memory consumption by including these strings in heade...

Updated xbmc package fixes a security vulnerability

Due to flaws in the embedded copy of libDCR, a fork of dcraw.c, in the embedded copy of CxImage, opening a specially crafted photo file could trigger a division by zero, an infinite loop, or a null pointer dereference, resulting in a denial of service CVE-2013-1438. This update fixes those flaws...