SUSE-RU-2015:0611-1 Recommended update for SUSE Manager Server 2.1

This collective update for SUSE Manager Server 2.1 provides the following new features: Connect SUSE Manager to the SUSE Customer Center. Manage SLE12 systems. ISS: export/import information about cloned channels to support Service Pack migration on ISS slaves. FATE317789 New API calls:...

OpenJDK: Bytecode verification does not prevent ctor calls to this() and super() (Hotspot, 8035119)

Unspecified vulnerability in Oracle Java SE 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot...

Palliative: the sogou browser to continue the remote execution of arbitrary commands-bug warning-the black bar safety net

1. Update to the latest version ! 1.jpg 2. Search for a vulnerability, do some repair, the most fundamental Protocol of the jump limit is still not repaired. A. for signin. htmlXSSdo as shown below fix: ! 2.jpg Canonical seemingly written by a bunch of, very complex, but in reality: even defining...

CVE-2015-0626

The SOAP interface in Cisco Hosted Collaboration Solution HCS allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114...

CVE-2015-0626

The SOAP interface in Cisco Hosted Collaboration Solution HCS allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114...

Python-Pickle-Class-Constructor

Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form "pickling", and later recover the data back into an object hierarchy "unpickling". A vulnerability has been reported in the Pickle implementation...

SUSE-RU-2015:0393-1 Recommended update for SUSE Manager Server 2.1

This collective update for SUSE Manager Server 2.1 provides the following new features: ISS: export/import information about cloned channels to support Service Pack migration on ISS slaves. FATE317789 New API calls: system.scheduleSPMigration, system.scheduleDistUpgrade. FATE314785, FATE314340...

Arbitrary Write Privilege Elevation Vulnerability in Various K7 Computing Products

K7 Computing is an antivirus program. An arbitrary write elevation of privilege vulnerability exists in several K7 Computing products that allows a local user to write to arbitrary memory locations and gain elevated privileges by crafting 0x95002570, 0x95002574, 0x95002580, 0x950025a8, 0x950025ac...

glibc: __nss_hostname_digits_dots() heap-based buffer overflow

A heap-based buffer overflow was found in glibc's nsshostnamedigitsdots function, which is used by the gethostbyname and gethostbyname2 glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the...

WordPress Calls to Action Plugin <= 2.2.7 - Stored XSS

Unauthenticated users can update the content of any specific form on the site by the AJAX action "inboundformsave". Solution Update the plugin...

WordPress Calls to Action <= 2.2.7 - Stored XSS

The AJAX action ‘inboundformsave’ allows unauthenticated users to update the content of any specific form on the site. In order to exploit this, a form ID must be enumerated using another unauthenticated AJAX action, ‘inboundgetformdata’. Once a form ID has been enumerated, the content of the for...

K7 Total Security Privilege Escalation Vulnerability (Feb 2015) - Windows

K7 Total Security is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-8148

The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges...

UBUNTU-CVE-2014-8148

The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges...

CVE-2014-8148

The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges...

Vimeo: Make API calls on behalf of another user (CSRF protection bypass)

Hi! Brief I have discovered a way to issue API calls on behalf of other users. The problem stems from the fact that the API playground at https://developer.vimeo.com/api/playground/me has a very weak CSRF protection. The only thing protecting this resource from CSRF attacks is the demand that the...

Code injection

The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service uninitialized-memory read and...

CVE-2014-8640

The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service uninitialized-memory read and...

UBUNTU-CVE-2014-8640

The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service uninitialized-memory read and...

MGASA-2014-0555 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: In MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML, which could lead to cross-site scripting. Permission to edit MediaWiki namespace is required to exploit this. In MediaWiki before 1.23.8, a malicious site can bypas...