SUSE SLED10 / SLES10 Security Update : kernel (SUSE-SU-2012:1391-1)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed : CVE-2011-2494: kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to...

Unbreakable Enterprise kernel security and bugfix update

kernel-uek 3.8.13-68.2.2 - crypto: aesni - fix memory usage in GCM decryption Stephan Mueller Orabug: 21077385 CVE-2015-3331 3.8.13-68.2.1 - xen/pciback: Don't disable PCICOMMAND on PCI device reset. Konrad Rzeszutek Wilk Orabug: 20807438 CVE-2015-2150 - xen-blkfront: fix accounting of reqs when...

kernel security and bug fix update

2.6.32-504.16.2 - infiniband core: Prevent integer overflow in ibumemget address arithmetic Doug Ledford 1181173 1179327 CVE-2014-8159 2.6.32-504.16.1 - fs gfs2: Move gfs2filesplicewrite outside of ifdef Robert S Peterson 1198329 1193559 - security keys: close race between key lookup and freeing...

Coinbase: Blacklist bypass on Callback URLs

In bug 47368, I was able to reach private IP addresses via the "Test Now" button of the "Callback URL" feature. Exploiting this flaw allowed me to reach the metadata server of your outbound proxy which is, afaik, maintained by Proximo. A comment by aianus states that callbacks are now restricted...

Persistent Systems Client Automation - Command Injection Remote Code Execution (Metasploit)

Exploit Title: Persistent Systems Client Automation PSCA, formerly HPCA or Radia Command Injection Remote Code Execution Vulnerability Date: 2014-10-01 Exploit Author: Ben Turner Vendor Homepage: Previosuly HP, now http://www.persistentsys.com/ Version: 7.9, 8.1, 9.0, 9.1 Tested on: Windows XP,...

Apple OS X Yosemite system exposure more local to mention the right vulnerability-vulnerability warning-the black bar safety net

Foreign security researchers have recently exposed the latest version of Mac OSX 10.10.1 system on the presence of multiple local mention the right vulnerability, due to the submitted to Apple the official time for too long are not get a clear answer, leading the researcher directly to the...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

PT-2015-4248

Name of the Vulnerable Software and Affected Versions Moip module versions prior to 7.x-1.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback. Recommendations For Moip module versio...

CVE-2014-9500: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

MODX Revolution-pl Cross-Site Scripting Vulnerability

MODX Revolution is a content management system that claims to be the most flexible and open and free. A cross-site scripting vulnerability exists in MODX Revolution 2.3.2-pl, which allows remote attackers to inject arbitrary web script or HTML via callback parameters...

CVE-2014-8992

Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

PT-2014-8772

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.3.2-pl Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the callback parameter in the manager/assets/fileapi/FileAPI.flash.image.swf file...

CVE-2014-8992: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...

WS-2014-0038

“JMXJSONServlet” in Apache Hadoop versions 2.4.0 to 2.6.5 are vulnerable to XSS by passing a callback parameter in the JMX response...

PT-2020-7585 · Dbi +3 · Dbi +3

Name of the Vulnerable Software and Affected Versions: DBI module versions prior to 1.632 for Perl Description: An issue in the DBI module for Perl may lead to memory corruption when using many arguments to methods for Callbacks. Recommendations: For versions prior to 1.632, update to version 1.6...

CVE-2014-9153

Cross-site scripting XSS vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

PT-2014-8853

Name of the Vulnerable Software and Affected Versions Drupal Services module versions 7.x-3.x before 7.x-3.10 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

CVE-2014-9153: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...