Ruby on Rails XML Processor YAML Deserialization Scanner

This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby ...

Ruby on Rails XML Processor YAML Deserialization Code Execution

This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application...

Samsung Acknowledges Exynos Root Exploit

Samsung downplayed a root exploit vulnerability in some of its Exynos processors, and promised a patch for the flaw, according to a company statement acquired by AndroidCentral. The bug affects devices with Exynos 4210 and 4412 processors and was first made public by an XDA Developers forum membe...

CVE-2012-4856

The Service Processor in the IBM Power 5 91- and 940- before SF240418382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors...

Code injection

The Service Processor in the IBM Power 5 91- and 940- before SF240418382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-4856

The Service Processor in the IBM Power 5 91- and 940- before SF240418382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-4856

The CVE-2012-4856 vulnerability affects the IBM Power 5 Service Processor (multiple MTMs listed in vendor advisories) where the firewall code is not executed in certain network configurations, enabling remote attackers to execute arbitrary code. The underlying issue is the Service Processor faili...

CVE-2012-4856: Undefined Security Weakness

The Service Processor in the IBM Power 5 91- and 940- before SF240418382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2012-6422

The kernel in Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly other Android devices, when running an Exynos 4210 or 4412 processor, uses weak permissions 0666 for /dev/exynos-mem, which allows attackers to read or write arbitrary physical memory and gain privileges via a crafted...

CVE-2012-6422

The CVE-2012-6422 entry concerns the kernel on certain Android devices (Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly others) using weak permissions (0666) on /dev/exynos-mem when running an Exynos 4210/4412, enabling an attacker to read or write arbitrary physical memory and achieve p...

IBM Power 5 Service Processor privilege escalation vulnerability

Overview IBM Power 5 Service Processor contain a vulnerability which could allow an attacker to operate with elevated privileges. Description IBM's security advisory states, "A security issue has been identified on IBM Power 5 Systems such that the firewall code does not get executed in certain...

CVE-2012-2934

CVE-2012-2934 affects Xen 4.0/4.1 when a 64‑bit PV guest runs on older AMD CPUs; Xen fails to detect AMD Erratum #121, allowing a local unprivileged guest to cause a host hang (crash) via non‑canonical address handling. Debians/Red Hat advisories note mitigations: upgrade Xen to fixed releases (e...

DEBIAN-CVE-2012-6031

The dotmemget function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service CPU hang and host crash via unspecified vectors related to a spinlock being held in the "badcopy error path." NOTE: this issue was originally published as part o...

Code injection

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Panel Processor...

CVE-2012-3176: Undefined Security Weakness

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Panel Processor...

CVE-2012-3176

Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Panel Processor...

CVE-2012-3176

CVE-2012-3176 affects Oracle PeopleSoft: PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52. The vulnerability is described as an unspecified issue in Panel Processor that could allow remote authenticated users to impact integrity with unknown vectors. The NVD data lis...

Fedora Update for qemu FEDORA-2012-15740

Check for the Version of qemu OpenVAS Vulnerability Test Fedora Update for qemu FEDORA-2012-15740 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms o...

[SECURITY] Fedora 17 Update: qemu-1.0.1-2.fc17

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service CPU consumption via a request that contains many parameters and parameter values, a different vulnerability...