[SECURITY] Fedora 18 Update: ktimer-4.10.5-1.fc18

KTimer is a little tool to execute programs after some time...

[SECURITY] Fedora 18 Update: ktimer-4.10.4-1.fc18

KTimer is a little tool to execute programs after some time...

CVE-2013-0136: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service file deletion or renaming via 1 the uploadPath parameter...

Vulnerability in "Fujitsu Desktop Update" (for Windows)

Hi @ll, Fujitsu's update utility "Fujitsu Desktop Update" see http://support.ts.fujitsu.com/DeskUpdate/Index.asp, which is factory-preinstalled on every Fujitsu Siemens PC with Windows, has a vulnerability which allows the execution of a rogue program in the security context of the current user...

CVE-2012-6460

Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execution of arbitrary programs, via a crafted web site...

CVE-2012-2244: Undefined Security Weakness

Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav. NOTE: this can be exploited without authentication by leveraging CVE-2012-2243...

CVE-2012-4203: Undefined Security Weakness

The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows user-assisted remote attackers to run arbitrary programs by leveraging a javascript: URL in a bookmark...

CVE-2012-2990: Improper Control of Generation of Code

The MASetupCaller ActiveX control before 1.4.2012.508 in MASetupCaller.dll in MarkAny ContentSAFER, as distributed in Samsung KIES before 2.3.2.120741313, does not properly implement unspecified methods, which allows remote attackers to download an arbitrary program onto a client machine, and...

Permanent Reverse TCP Backdoor for IPhone and IPad

Security Expert from Coresec explains the use of a Permanent Reverse TCP Backdoor "sbd-1.36" for IPhone and IPad developed by Michel Blomgren. sbd is a Netcat-clone, designed to be portable and offer strong encryption. It runs on Unix-like operating systems and on Microsoft Win32. sbd features...

CVE-2011-4786: Improper Control of Generation of Code

A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4787...

CVE-2011-4837: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs...

FFFTP < 1.98b Untrusted Search Path Vulnerability - Windows

FFFTP is prone to untrusted search path vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-2404: Improper Control of Generation of Code

A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-4786 and CVE-2011-4787...

UUSee UUPlayer ActiveX控件多个远程代码执行漏洞

Bugtraq ID: 48975 CVE ID：CVE-2011-2589 CVE-2011-2590 UUSee是一款集P2P直播点播于一身的网络电视软件。 UUSee存在两个安全漏洞，允许攻击者以应用程序上下文执行任意代码。 -当处理"SendLogAction"方法时UUPlayer ActiveX控件存在边界错误，通过提交超长参数可触发基于堆的缓冲区溢出。 -当处理"Play"方法时UUPlayer ActiveX控件存在输入验证错误，向"MPlayerPath"参数传递UNC路径可以应用程序上下文执行任意程序。 UUSee UUPlayer 6.0.0.1 厂商解决方案...

CVE-2011-2963

TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service crash via a crafted packet to TCP port 10651...

DSquare Exploit Pack: D2SEC_CISCOANY

Name| d2secciscoany ---|--- CVE| CVE-2011-2040 Exploit Pack| D2ExploitPack Description| Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability Notes|...

CVE-2011-1566: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System IGSS allows remote attackers to execute arbitrary programs via ..\ dot dot backslash sequences in opcodes 1 0xa and 2 0x17 to TCP port 12397...

CVE-2011-0751: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in nhttpd aka Nostromo webserver before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f encoded dot dot slash in a URI...

CVE-2011-1036: Undefined Security Weakness

The XML Security Database Parser class in the XMLSecDB ActiveX control in the HIPSEngine component in the Management Server before 8.1.0.88, and the client before 1.6.450, in CA Host-Based Intrusion Prevention System HIPS 8.1, as used in CA Internet Security Suite ISS 2010, allows remote attacker...

CVE-2010-4506: Undefined Security Weakness

Passlogix v-GO Self-Service Password Reset SSPR and OEM before 7.0A allows physically proximate attackers to execute arbitrary programs without authentication by triggering use of an invalid SSL certificate and using the Internet Explorer interface to navigate through the filesystem via a "Save A...