CVE-2015-3259: Undefined Security Weakness

Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument...

PT-2015-1557 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Internet Explorer affected versions not specified Description: The issue is caused by a buffer overflow in dynamic memory, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service using a specially...

Microsoft Releases July 2015 Security Bulletin

Microsoft has released 14 updates to address vulnerabilities in Microsoft Windows. Exploitation of some of these vulnerabilities could allow remote code execution or elevation of privileges. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS15-058 and MS15-065...

Updates Available for Flash AS3 opaqueBackground and BitmapData Use-After-Free Vulnerabilities

Adobe has released security updates to address critical vulnerabilities within the ActionScript 3 opaqueBackground and BitmapData classes of Flash Player. Exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code on a vulnerable system. Versions affected includ...

VMware Releases Security Advisory

VMware has released security updates to address a host privilege escalation vulnerability in VMware Workstation, Player and Horizon View Client for Windows. Exploitation of this vulnerability may allow an attacker to escalate privileges on an affected VMware system. Updates available include:...

WordPress SearchTerms Tagging Plugin <= 2 1.535 - Authenticated SQL Injection

Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands. Solution Upgrade the plugin...

Adobe Releases Security Updates for Flash Player

Adobe has released security updates to address multiple vulnerabilities in Flash Player for Windows, Macintosh, and Linux. These include a critical vulnerability CVE-2015-5119 in Adobe Flash Player 18.0.0.194 and earlier versions. Adobe is aware of a report that an exploit targeting CVE-2015-5119...

abrt: default abrt event scripts lead to information disclosure

It was found that the ABRT event scripts created a user-readable copy of an sosreport file in ABRT problem directories, and included excerpts of /var/log/messages selected by the user-controlled process name, leading to an information disclosure. The fix for this issue prevents non-privileged use...

WordPress Awesome Filterable Portfolio Plugin <= 1.8.6 - SQL Injection

Because of this vulnerability, logged administrators can execute arbitrary SQL commands. Solution Update the plugin...

Adobe Flash ActionScript 3 ByteArray Use-After-Free Vulnerability

Adobe Flash Player contains a vulnerability within the ActionScript 3 ByteArray class, which can allow a remote attacker to execute arbitrary code on a vulnerable system. Versions affected include Adobe Flash Player 9.0 through 18.0.0.194. Users and administrators are encouraged to review...

Security Updates for Node.js and io.js

Networking applications using Node.js or io.js contain a vulnerability in the V8 JavaScript engine. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition. Available updates include: node.js-v0.12.6 io.js-v2.2.3 io.js-v1.8.3 Users and administrators...

Updated drupal package fixes security vulnerability

Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users CVE-2015-3231. A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites CVE-2015-3232. Due to insufficient URL validation, the Overlay module could be...

CVE-2015-2965

Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors...

TeemIp - IP Address Management Solution

All network administrators do recognize how important it is to have a well managed IP space: a comprehensive and up to date inventory of all subnets and IPs used in a network as well as clear and simple processes to request, change or release IPs are underlying key factors for a trouble free...

Cisco WebEx Meeting Center GET Parameter Vulnerability

A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to view sensitive information that is transmitted in GET parameters or perform SQL injection. The vulnerability is due to the inclusion of sensitive information in the URL as GET parameters. An attacker...

Symantec Endpoint Protection Management Console SQL Injection Vulnerability

Symantec Endpoint Protection is a protection software developed to enhance enterprise virus protection and advanced threat defense. Symantec Endpoint Protection management console fails to properly validate user input and administrators with low privileges can perform SQL injection attacks with...

Google Releases Security Update for Chrome

Google has released Chrome version 43.0.2357.130 for Windows, Mac, and Linux to address multiple vulnerabilities. Exploitation of one of these vulnerabilities may allow an attacker to obtain sensitive information. Users and administrators are encouraged to review the Chrome Releases Page and appl...

CVE-2015-4677

Cross-site request forgery CSRF vulnerability in FiverrScript aka Fiverr Script 7.2 allows remote attackers to hijack the authentication of administrators for requests that create a new admin via a request to administrator/adminscreate.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in FiverrScript aka Fiverr Script 7.2 allows remote attackers to hijack the authentication of administrators for requests that create a new admin via a request to administrator/adminscreate.php...

CVE-2015-4677

FiverrScript 7.2 is affected by a cross-site request forgery (CSRF) vulnerability that lets an attacker hijack an administrator’s session to create a new admin via the administrator/admins_create.php endpoint. The root cause is CSRF in the admin-creation flow, enabling unauthorized actions in the...