Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users...

Without jailbreak iPhone 6 on steal Alipay and wechat payment account password-loophole warning-the black bar safety net

The vulnerability is iOS system vulnerabilities,and Alipay,wechat app has nothing to do. This article just take Alipay and micro letter as a demonstration of the vulnerability of the application,other applications can also be caught,forwarding those who do not taken out of context. This...

Apple killed the previous jailbreak also inadvertently fixes a new vulnerability-vulnerability warning-the black bar safety net

Apple some time ago released iOS 8.2 to fix the Tai Chi team in the 8.2 Beta 1/Beta 2 jailbreak which used the vulnerability, which is apples and Tai Chi teams are already confirmed. Tai Chi also reminded the majority of jailbreak users, currently for the iOS 8.2 jailbreak tools are still being...

Apple Safari WebKit Vulnerabilities Patched

Apple on Tuesday pushed out new versions of its Safari browser that address 17 security vulnerabilities in the WebKit engine. Safari 8.04, 7.14 and 6.24 patch multiple memory corruption issues in WebKit, Apple said. “These issues were addressed through improved memory handling,” Apple said in its...

Apple Fixes FREAK Bug, iCloud Flaw in iOS 8.2

Apple has patched the FREAK SSL vulnerability, along with a nasty bug that could’ve allowed a remote attacker to restart a user’s iPhone via SMS, with the release of iOS 8.2. The new version of Apple’s mobile operating system contains a number of vulnerability fixes, with the FREAK patch being th...

Apple Addresses FREAK and Releases Security Updates for OS X, iOS, and Apple TV

Apple has released security updates for OS X, iOS, and Apple TV to address multiple vulnerabilities, one of which may allow an attacker to decrypt secure communications between vulnerable clients and servers FREAK. Updates available include: Xcode 6.2 for OS X Mavericks v10.9.4 or later Security...

ManageEngine EventLog Analyzer Multiple Vulnerabilities

ManageEngine EventLog Analyzer version 9.9 suffers from unauthenticated remote code execution via shell upload and authorization vulnerabilities. Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer...

KLA10359 Vulnerability in Tableau

An obsolete version of OpenSSL was found in Tableau. By exploiting this vulnerability malicious users can cause denial of service, obtain sensitive information and bypass security. This vulnerability can be exploited remotely. Original advisories Tableau changelog Exploitation Public exploits exi...

SuSE Linux Professional 8.2 SuSEWM Configuration File Insecure Temporary File Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8778/info A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges. / Proof of Concept for SuSEconfig.vmware Symbolic Link...

radscan conquest 8.2 - Multiple Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/22855/info Conquest is prone to multiple remotely exploitable vulnerabilities, including a stack-based buffer-overflow vulnerability and a memory-corruption vulnerability. An attacker can exploit these issues to execute...

CdRecord Version <= 2.0 - Mandrake local root exploit

No description provided by source. !/usr/bin/perl Cdrecord version 2.0 and local root exploit. wsxz@localhost buffer$ perl priv8cdr.pl 4 Using target number 4 Using Mr .dtors 0x808c82c Cdrecord 2.0 i586-mandrake-linux-gnu scsibus: -1 target: -1 lun: -1 Warning: Open by 'devname' is unintentional...

dvbbs 8.2 - 'login.asp' Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/29429/info The 'dvbbs' program is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attack...

eNdonesia 8.2/8.3 Mod Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8506/info It has been reported that eNdonesia is prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a victim's browser. The issue reportedly exists in the...

NEdit 5.5 - Format String Vulnerability

No description provided by source. Exploit Title: Format string vulnerability in Nedit = 5.5. Date: 04/13/2011 Author: Tosh The bug was already patched when I'd found the vuln Email: [email protected] Patch:...

ICS-CERT Warns of Heartbleed Vulnerabilities in Siemens Gear

A number of ICS products from Siemens and Innominate are vulnerable to the OpenSSL heartbleed flaw, some of which do not have updates available yet. The list of products affected by the heartbleed vulnerability continues to grow by the day, with OpenVPN being one of the latest. A researcher on...

Code injection

Cisco Adaptive Security Appliance ASA Software 8.2 before 8.25.47, 8.4 before 8.47.5, 8.7 before 8.71.11, 9.0 before 9.03.10, and 9.1 before 9.13.4 allows remote authenticated users to gain privileges by leveraging level-0 ASDM access, aka Bug ID CSCuj33496...

Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-105-03A Siemens Industrial Products OpenSSL Heartbleed Vulnerability that was published April 29, 2014, on the NCCIC/ICS-CERT web site. Siemens reported to ICS-CERT a list of products affected by the OpenSSL...

CVE-2013-5421

Cross-site scripting XSS vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO 8.2 allows remote attackers to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form...

Sql injection

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ backslash in a message...

CVE-2013-4422

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ backslash in a message...