LiveZilla 5.1.1.0 Cross Site Scripting

Author: Jakub Zoczek [email protected] CVE Reference: CVE-2013-7003 Product: LiveZilla Vendor: LiveZilla GmbH http://livezilla.net Affected version: 5.1.1.0 Severity: Medium CVSSv2 Score: 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Status: Fixed 0x01 Background LiveZilla, the widely-used and trusted Live Help...

Proof-of-Concept App Released for Android Jelly Bean Security Bypass Bug

The researchers who discovered a serious vulnerability in Android 4.3 Jelly Bean that enables a malicious app to disable the security locks on a vulnerable device have published a proof-of-concept app that exploits the bug, as well as source code for the app. The vulnerability in question lies in...

Vulnerability in Android 4.3 allows apps to Remove Device Locks, POC app released

None...

SAP Sybase Adaptive Server Enterprise SQL Injection (SAP Note 1893440)

SAP Sybase Adaptive Server Enterprise ASE contains a flaw that may allow an attacker to carry out a SQL injection attack. The issue is due to the program not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in t...

Design/Logic Flaw

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for 1 VMLAUNCH and 2 VMRESUME, which allows local HVM guest users to cause a denial of service host crash via unspecified vectors related to "guest VMX instruction execution."...

CVE-2013-4551

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for 1 VMLAUNCH and 2 VMRESUME, which allows local HVM guest users to cause a denial of service host crash via unspecified vectors related to "guest VMX instruction execution."...

Android 4.3 Superuser Root Privilege Escalation

Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain, non-default device configurations. Android 4.3 introduced the concept of "restricted profiles," created through the Settings - Users menu. A...

CVE-2013-4416

The Ocaml xenstored implementation oxenstored in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service domain shutdown via a large message reply...

Another Master Key vulnerability discovered in Android 4.3

None...

CVE-2013-1734

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via a...

CVE-2013-4370

The ocaml binding for the xcvcpugetaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service heap corruption and crash and possibly execute arbitrary code via unspecified vectors that trigger a 1...

Double free

The ocaml binding for the xcvcpugetaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service heap corruption and crash and possibly execute arbitrary code via unspecified vectors that trigger a 1...

CVE-2013-4370

The ocaml binding for the xcvcpugetaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service heap corruption and crash and possibly execute arbitrary code via unspecified vectors that trigger a 1...

Null pointer dereference

The xluvifparserate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service NULL pointer dereference by using the "@" character as the VIF rate configuration...

Design/Logic Flaw

Use-after-free vulnerability in the libxllistcpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service heap corruption and crash...

CVE-2013-4371

CVE-2013-4371 affects Xen 4.2.x and 4.3.x where libxl_list_cpupool exhibits a use-after-free when memory is tight; a failed realloc returns the original pointer, enabling heap corruption and potential local denial of service or arbitrary code execution. SUSE advisory SUSE-SU-2013:1774-1 notes Xen...

Android Settings Remove Device Locks (4.0-4.3)

This module exploits a bug in the Android 4.0 to 4.3 com.android.settings.ChooseLockGeneric class. Any unprivileged app can exploit this vulnerability to remove the lockscreen. A logic flaw / design error exists in the settings application that allows an Intent from any application to clear the...

CVE-2013-4356

Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service crash...

CVE-2013-4356

Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service crash...

CVE-2013-5967

CVE-2013-5967 affects AlienVault OSSIM (Open Source Security Information Management) 4.3 and earlier. The vulnerability is due to improper sanitization of the date_from parameter in multiple RadarReport scripts (e.g., radar-iso27001-potential.php and related radar-pci-potential.php) and in relate...