Design/Logic Flaw

Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a...

Apple TV and iOS Enterprise Signature App Security Bypass Vulnerability

Apple iOS is the latest operating system for Apple's iPhone and iPod touch devices. Apple TV is Apple's way of allowing photos, videos and music from PCs and iPods to be transmitted wirelessly to a TV in high definition. A security vulnerability exists in the Apple TV and iOS Enterprise Signature...

Multiple PDF products Launch Action Command Code Execution (APSB10-15) - Ver2 (CVE-2010-1240)

Portable Document Format PDF is an open file format created by Adobe Systems. A vulnerability has been discovered in Adobe Reader. The vulnerability is due to an error in the Adobe Reader that fails to restrict the contents of one text field in the Launch File warning dialog, which makes it easie...

CVE-2014-0748

apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912...

Android WAPPushManager - SQL Injection

Android WAPPushManager - SQL Injection INTRODUCTION ================================== In Android 5.0, a SQL injection vulnerability exists in the opt module WAPPushManager, attacker can remotely send malformed WAPPush message to launch any activity or service in the victim's phone need permissio...

Android WAPPushManager - SQL Injection

INTRODUCTION ================================== In Android 5.0, a SQL injection vulnerability exists in the opt module WAPPushManager, attacker can remotely send malformed WAPPush message to launch any activity or service in the victim's phone need permission check DETAILS...

DEBIAN-CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

CVE-2014-7157

Cross-site scripting XSS vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to inject arbitrary web script or HTML via the tabsel parameter to admin/launch...

openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1228-1)

DBUS-1 was upgraded to upstream release 1.8. This brings the version of dbus to the latest stable release from an unstable snapshot 1.7.4 that is know to have several regressions - Upstream changes since 1.7.4 : + Security fixes : - Do not accept an extra fd in the padding of a cmsg message, whic...

No title provided

A cross-site scripting XSS flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. CVE-2014-3473 It was found that network names were not sanitized. A malicious user could use this flaw to...

China Develops Facial Recognition Payment System with Near-Perfect Accuracy

In an intent to move one step forward from others, China is planning to launch a facial recognition payment application with near-perfect accuracy that enables users to authorize their online transactions just by showing a picture of themselves. Chinese researchers from the Chongqing-based resear...

WordPress Plugin WP to Twitter - Authentication Bypass

WordPress Plugin WP to Twitter - Authentication Bypass source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...

[SECURITY] Fedora 19 Update: tboot-1.8.2-1.fc19

Trusted Boot tboot is an open source, pre-kernel/VMM module that uses Intel Trusted Execution Technology Intel TXT to perform a measured and verified launch of an OS kernel/VMM...

[SECURITY] Fedora 20 Update: tboot-1.8.2-1.fc20

Trusted Boot tboot is an open source, pre-kernel/VMM module that uses Intel Trusted Execution Technology Intel TXT to perform a measured and verified launch of an OS kernel/VMM...

No title provided

A cross-site scripting XSS flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. CVE-2014-3473 It was found that network names were not sanitized. A malicious user could use this flaw to...

CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

PT-2014-5346

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard Horizon versions 2013.2.3 and earlier OpenStack Dashboard Horizon versions 2014.1 and earlier, excluding 2014.1.2 and later OpenStack Dashboard Horizon versions Juno and earlier, excluding Juno-2 and later Description A...

UBUNTU-CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...