PACTware Exceptional Conditions Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a handling of exceptional conditions vulnerability in PACTware Consortium’s PACTware application. PACTware Consortium has produced a new service pack that mitigates this vulnerability. Ivan Sanchez has tested the new version to validate that...

Generic DLL Injection From Shared Resource

This is a general-purpose module for exploiting conditions where a DLL can be loaded from a specified SMB share. This module serves payloads as DLLs over an SMB service. Module Options msf use exploit/windows/smb/generic/smbdllinjection msf undefinedsmbdllinjection show actions ...actions... msf...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 6.4 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...

bind -- denial of service vulnerability

ISC reports: When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors...

Microsoft Internet Explorer CVE-2015-0053 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Windows win32k.sys Dangling Pointer Privilege Escalation Vulnerability

This vulnerability allows for elevation of privilege on vulnerable installations of Microsoft Windows. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The specific flaw exists within the usage of Cursor objects. The issue lies in the...

Adobe Flash Player Multiple Unspecified Security Vulnerabilities

Description Adobe Flash Player is prone to multiple unspecified security vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause denial-of-service conditions. Technologies Affected Adobe...

Apple-QuickTime-7.5-(.m3u)

Apple QuickTime is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result i...

OracleVM 2.2 : glibc (OVMSA-2015-0024) (GHOST)

The remote OracleVM system is missing necessary patches to address critical security updates : - Switch to use malloc when the input line is too long Orabug 19951108 - Use a /sys/devices/system/cpu/online for SCNPROCESSORSONLN implementation Orabug 17642251 Joe Jin - Fix parsing of numeric hosts ...

openssl: Bignum squaring may produce incorrect results

It was found that OpenSSL's BigNumber Squaring implementation could produce incorrect results under certain special conditions. This flaw could possibly affect certain OpenSSL library functionality, such as RSA blinding. Note that this issue occurred rarely and with a low probability, and there i...

Oracle Solaris Third-Party Patch Update : icu (cve_2013_0900_race_conditions)

The remote Solaris system is missing necessary patches to address security updates : - Race condition in the International Components for Unicode ICU functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a...

Oracle Solaris Third-Party Patch Update : proftpd (cve_2012_6095_race_conditions)

The remote Solaris system is missing necessary patches to address security updates : - ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the 1 MKD or 2 XMKD commands. CVE-2012-609...

Multiple znc security vulnerabilities

Multiple DoS conditions...

Padding-oracle attack on TLS CBC cipher mode

A vulnerability affecting some implementations of TLS 1.x with CBC cipher modes has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-8730. This padding-oracle attack on TLS CBC cipher modes is a variant of the POODLE vulnerability,...

c-icap DoS

Few different DoS conditions...

Zarafa WebApp Denial of Service Vulnerability

Zarafa WebApp is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zarafa:webapp"; ...

Malicious iFrame Conditional Cookie Injection

Several web exploitation tools inject payloads that are displayed only when specific conditions are met. This may allow an attacker to reduce the odds of detection and to evade inspection...

Mandriva Linux Security Advisory : libvncserver (MDVSA-2014:229)

Updated libvncserver packages fix security vulnerabilities : A malicious VNC server can trigger incorrect memory management handling by advertising a large screen size parameter to the VNC client. This would result in multiple memory corruptions and could allow remote code execution on the VNC...

wireshark multiple security vulnerabilities

Buffer overflow and DoS-conditions on different protocols parsing...

MGASA-2014-0466 Updated kdenetwork4 packages fix security vulnerabilities in krfb

A malicious VNC client can trigger multiple DoS conditions on the VNC server by advertising a large screen size, ClientCutText message length and/or a zero scaling factor parameter CVE-2014-6053, CVE-2014-6054. A malicious VNC client can trigger multiple stack-based buffer overflows by passing a...