qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

qpid-cpp: anonymous access to qpidd cannot be prevented

It was discovered that the Qpid daemon qpidd did not restrict access to anonymous users when the ANONYMOUS mechanism was disallowed...

CVE-2015-0820

Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web...

Debian Security Advisory DSA 3170-1 (linux - security update)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation. CVE-2013-7421 / CVE-2014-9644 It was discovered that the Crypto API allowed unprivileged users to load arbitrary kernel modules. A local user can use...

CVE-2015-1427

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

CVE-2014-6362

Use-after-free vulnerability in Microsoft Office 2007 SP3, 2010 SP2, and 2013 Gold and SP1 allows remote attackers to bypass the ASLR protection mechanism via a crafted document, aka "Microsoft Office Component Use After Free Vulnerability."...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-2490-1)

Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage TLS implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization ASLR protection mechanism. A local user could exploit this fla...

Design/Logic Flaw

The machportkobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app...

CVE-2014-8838

CVE-2014-8838 affects macOS OS X prior to 10.10.2, where the Security component mishandles cached app certificate information. This allows a crafted app signed with a revoked Developer ID to bypass Gatekeeper checks, as described in the vulnerability entry and corroborated by vulnerability listin...

CVE-2014-8838

The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates, which allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate for signing a crafted app...

CVE-2014-5233

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism...

Code injection

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to discover Sm@rtServer credentials by leveraging an error in the credential-processing mechanism...

CVE-2014-5233

Siemens SIMATIC WinCC Sm@rtClient for iOS (pre-1.0.2) has an information-credential flaw: an error in the credential-processing/handling allows a physically proximate attacker with local access to extract Sm@rtServer credentials. The issue is tied to the app’s credential-storage/processing mechan...

Privilege escalation

mrxdav.sys aka the WebDAV driver in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonatio...

ASUS router aeration Root privileges command execution vulnerability-vulnerability warning-the black bar safety net

! 2 copya foreign security researchers the 6th of this month in the online disclosure, the ASUS router firmware there is a serious vulnerability that allows the execution of unauthorized commands, and may exist in all current versions of ASUS router firmware. Currently, there is already an exploi...

CVE-2014-8275

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion,...

Samsung KNOX remote silent installation vulnerabilities in-depth analysis of the report-vulnerability warning-the black bar safety net

Vulnerability sources 1 1 In mid-May, the Samsung phone is a foreign security researchers exposed a serious security vulnerability,the vulnerability affects the Galaxy S5,S4,S4 mini,Note 4,Note3 and Ace 4 supports knox, a full line of Samsung phones, part of the GalaxyS5, and the Note 4 has been...

Intel BIOS locking mechanism contains race condition that enables write protection bypass

Overview A race condition exists in Intel chipsets that rely solely on the BIOSCNTL.BIOSWE and BIOSCNTL.BLE bits as a BIOS write locking mechanism. Successful exploitation of this vulnerability may result in a bypass of this locking mechanism. Description CWE-362: Concurrent Execution using Share...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi-bin/ipinfo.cgi in IPCop aka IPCop Firewall before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING. NOTE: this can be used to bypass the cross-site request forgery CSRF protection mechanism by setting the Refere...