4429 matches found
Oracle Solaris has a local vulnerability
Oracle Solaris is a unix-based operating system. A local vulnerability exists in Oracle Solaris that could be exploited by an attacker to compromise a 'Libc' subcomponent...
Microsoft XML Core Services vulnerability is still computer users face the biggest risk-vulnerability warning-the black bar safety net
Recently reported, Microsoft XML Core Services vulnerability is still computer users face the biggest risk, and more than 4 3% of users are running a vulnerable version. Can you explain why these problems still exist as well as to alleviate the problem the best way? Michael Cobb: the Secunia in t...
PortExpert - Monitors all applications connected to the Internet
PortExpert gives you a detailed vision of your personnal computer cybersecurity. It automatically monitors all applications connected to the Internet and give you all the information you might need to identify potential threats to your system. Features Monitor of application using TCP/UDP...
How to relieve Microsoft XML vulnerability risk-the vulnerability warning-the black bar safety net
Recently reported, Microsoft XML Core Services vulnerability is still computer users face the biggest risk, and more than 4 3% of users are running a vulnerable version. Can you explain why these problems still exist as well as to alleviate the problem the best way? ! How to relieve Microsoft XML...
X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps
It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...
Tor Project Warns of Possible Upcoming Attack on Network
The Tor Project is warning that an unnamed attacker is planning to try to cripple the network by seizing directory authorities, the servers that help Tor clients find Tor relays in the network. Tor officials said that the network right now is still safe to use, and also emphasized that they are...
phpyun csrf修改用户密码
简要描述： phpyun csrf修改用户密码 详细说明： 更新用户信息的请求没有防御csrf。可以修改用户的邮箱。而重置密码功能是选择用户信息中的邮箱发送找回验证码。结合利用。 修改用户信息的请求为:...
PHP WDDX Serializier Data Injection Vulnerability-vulnerability warning-the black bar safety net
PHP WDDX Serializier Data Injection Vulnerability Taoguang Chen - 2014.11.2 PHP in the array is serialized into a WDDX structure of the process, there is no array key name strictly limited, can lead to falsification of the object WDDX structure. i serialize the object PHP in the object is...
[RT-SA-2014-008] Python CGIHTTPServer File Disclosure and Potential Code Execution
Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...
F5 Networks BIG-IP : bzip2 vulnerability (SOL9592)
The remote BIG-IP device is missing a patch required by a security advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL9592. The text description of this plugin is C F5 Networks...
IRCCloud: Unvalidated Channel names causes IRC Command Injection
IRCCloud does not validate the channel names created by a user causing it to be parsed as an IRC command such as QUIT. This means the user can have their clients force-closed by a malicious channel name. This could also lead to other command injections such as forcing the handover of channels to...
rsyslog -- remote syslog PRI vulnerability
The rsyslog project reports: potential abort when a message with PRI 191 was processed if the "pri-text" property was used in active templates, this could be abused to a remote denial of service from permitted senders The original fix for CVE-2014-3634 was not adequate...
DSA-3039-1 chromium-browser - security update
Bulletin has no description...
python2: Information leakage through integer overflow
It was reported that Python 2.7.8 fixes a potential wraparound in buffer with possible CWE-200 implications. This could allow an attacker to access private information through information leakage. PoC: --- overflow.py --- import sys a = bytearray'here be dragons' b = buffera, sys.maxsize,...
[20140904] - Core - Denial of Service
Inadequate checking allowed the potential for a denial of service attack...
[20140903] - Core - Remote File Inclusion
Inadequate checking allowed the potential for remote files to be executed...
PHP multiple vulnerabilities
The PHP Team reports: insecure temporary file use in the configure script unserialize SPL ArrayObject / SPLObjectStorage Type Confusion Heap buffer over-read in DateInterval fileinfo: cdfreadshortsector insufficient boundary check fileinfo: CDF infinite loop in nelements DoS fileinfo: fileinfo:...
Fixed potential path traversal attack and remote code injection
This is a security release. All users MUST upgrade to this release to prevent two potential security issues: path traversal attack remote code injection These two security issues have been reported by Andreas Forsblom. THANKS! Below is the original report Andreas sent me: Hi William, First, thank...
SUSE-SU-2015:0901-1 Security update for libtasn1
libtasn1 has been updated to fix three security issues: asn1getbitder could have returned negative bit length CVE-2014-3468 Multiple boundary check issues could have allowed DoS CVE-2014-3467 Possible DoS by NULL pointer dereference in asn1readvaluetype CVE-2014-3469 Security Issues: CVE-2014-346...