DEBIAN-CVE-2014-9294

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-8133

arch/x86/kernel/tls.c in the Thread Local Storage TLS implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a...

Google Proposes Marking 'HTTP' as Insecure in 2015

The Chromium security team is devising a plan to explicitly and actively inform users that ‘HTTP’ connections provide no data security protections. Google’s grand vision is that some day, HTTPS will become so widespread and commonplace that secure connections can be unmarked in the way that HTTP...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2446-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2446-1 advisory. Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment SS register in the x86 architecture. A...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2445-1)

An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine KVM paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the...

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2447-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2447-1 advisory. Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment SS register in the x86 architecture. A...

USN-2446-1: Linux kernel vulnerabilities

Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment SS register in the x86 architecture. A local attacker could exploit this flaw to gain administrative privileges. CVE-2014-9322 An information leak in the Linux kernel was discovered...

USN-2444-1: Linux kernel (OMAP4) vulnerabilities

Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace subsystem of the Linux kernel does not properly handle private syscall numbers. A local user could exploit this flaw to cause a denial of service OOPS. CVE-2014-7826 Rabin Vincent, Robert Swiecki, Russell Kinglaw discovered a...

Sniffit Root Shell

CVE-2014-5439 - Root shell on Sniffit Authors: Ismael Ripoll & Hector Marco CVE: CVE-2014-5439 Dates: July 2014 - Discovered the vulnerability Description Sniffit is a packet sniffer and monitoring tool. A bug in sniffit prior to 0.3.7 has been found. The bug is caused by an incorrect...

Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability

A vulnerability in the web framework code of Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to perform a cross-site request forgery CSRF attack. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by...

Lame Duck Senate to Vote on NSA Reforming USA FREEDOM Act

The United States Senate will move to vote on the USA FREEDOM Act before the current congressional session closes at the end of the year, a move that pleases digital rights groups. In its current form, the bill would ban the bulk collection of Americans’ private records while granting the...

RHEL 6 : rhev-hypervisor6 (RHSA-2012:1200)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:1200 advisory. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization...

SEO Control Panel 3.6.0 SQL Injection Vulnerability

SEO Control Panel version 3.0 suffers from a remote authenticated SQL injection vulnerability. Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection Date: 10/10/2014 Exploit Author: Tiago Carvalho email protected or email protected Vendor Homepage: www.seopanel.in Software Link:...

SEO Control Panel 3.6.0 - (Authenticated) SQL Injection

Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection Date: 10/10/2014 Exploit Author: Tiago Carvalho [email protected] or [email protected] Vendor Homepage: www.seopanel.in Software Link: http://www.seopanel.in/spdownload/ Version: Seo Panel Version 3.6.0 Tested on: Ka...

Square: CSRF on adding a calendar event

Signup for a free account at the URL - https://www.bookfresh.com/users/signup Authenticate to the account created above. Navigate to My Business - Settings - Account Info - Account Type - Edit Click on "Delete your account" and confirm the deletion on the next page. Notice that you receive an ema...

Microsoft Releases EMET 5.0 Exploit Mitigation Tool

The latest version of Microsoft’s freely available stopgap against zero-day exploits was released today with two new exploit mitigations and a batch of new configuration options. The update to Microsoft’s Enhanced Mitigation Experience Tool kit, or EMET, comes six months after a technical preview...

Netscape Communicator 4.x URL Read Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1546/info A flaw in Netscape Communicator's implementation of Java allows malicious applets to read any resource reachable via a URL from the local machine by using the netscape.net.URLConnection and...

D-Link DSL-2740B - Multiple CSRF Vulnerabilities

No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : D-Link DSL-2740B ADSL Router CSRF Vulnerability Date : 09-08-2013 Author : Ivano Binetti http://ivanobinetti.com...

Esoftpro Online Guestbook Pro Multiple Vulnerabilities

No description provided by source. Exploit Title: Esoftpro Online Guestbook Pro Multiple Vulnerability Vendor url:http://www.esoftpro.com/ Version:5.1 Author: L0rd CrusAd3r aka VSN [email protected] Published: 2010-07-4 Greetz to:r0073r inj3ct0r.com, Sid3^effects, MaYur, MA1201, Sonic Bluehat...

Mandriva Linux Security Advisory : python-django (MDVSA-2014:113)

Multiple vulnerabilities has been discovered and corrected in python-django : Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive...