Hardware timer context is not properly context switched on ARM

ISSUE DESCRIPTION When running on an ARM platform Xen was not context switching the CNTKCTLEL1 register, which is used by the guest kernel to control access by userspace processes to the hardware timers. This meant that any guest can reconfigure these settings for the entire system. IMPACT A...

PT-2016-2634

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.11 on ARM platforms Android versions prior to 2016-08-05 on Nexus 5 and 7 2013 devices Description The issue is related to improper consideration of user-space access to the TPIDRURW register. This allows local...

kernel: block: passing disk names as format strings

Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device nam...

PyroCMS "email"跨站脚本漏洞

PyroCMS是一款内容管理系统。 由于传递到index.php/register中"email" POST参数的输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 PyroCMS 2.2.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： https://www.pyrocms.com/...

MODBUS/TCP 'Clear Counters and Diagnostic Register' Function Code Detection

Binary data 7102.pasl...

VideoCharge Studio 2.12.3.685 - GetHttpResponse() Man In The Middle Remote Code Execution

VideoCharge Studio 2.12.3.685 - GetHttpResponse Man In The Middle Remote Code Execution !/usr/bin/python Exploit Title: VideoCharge Studio v2.12.3.685 GetHttpResponse MITM Remote Code Execution Exploit SafeSEH/ASLR/DEP Bypass Version: v2.12.3.685 Date: 2014-02-19 Author: Julien Ahrens @MrTuxracer...

WHMCS 5.2.8 – SQL Injection Vulnerability-vulnerability warning-the black bar safety net

Google Dork: "powered by WHMCS" Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerable file: /includes/dbfunctions.php POC: selectquery function is vulnerable due to Register Globals Example...

Verizon Releases First Transparency Report, Says Government Requests INcreasing

After months of public calls from privacy advocates and security experts, Verizon on Wednesday released its first transparency report, revealing that it received more than 164,000 subpoenas and between 1,000 and 2,000 National Security Letters in 2013. The report, which covers Verizon’s landline,...

Wallpaper Script 3.5.0082 - Persistent Cross-Site Scripting

Wallpaper Script 3.5.0082 - Persistent Cross-Site Scripting Exploit Title : Wallpaper Script Stored XSS Vulnerability D0rk Google : Author : nullp0int3r [email protected] Version : 3.5.0082 Date : 2013-12-14 Vendor Homepage: http://www.wallpaperscript.com/ Test on : Windows Exploitation: 1...

Microsoft Tagged Image File Format (TIFF) Integer Overflow Vulnerability

Exploit for windows platform in category remote exploits require 'msf/core' require 'rex/zip' require 'nokogiri' module ::Nokogiri module XML class Builder Some XML documents don't declare the namespace before referencing, but Nokogiri requires one. So here's our hack to get around that by adding...

kernel: block: passing disk names as format strings

Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device nam...

Microsoft Changes Bug Bounty Program to Include Incident Responders, Forensics Specialists

Having found some initial success with its first foray into the bug bounty world, Microsoft is expanding the program to open up payments of up to $100,000 to incident response teams and forensics experts who come across active attacks in the wild that include new techniques that bypass exploit...

phpscup enterprise built Station system v1. 8. 2-stored xss vulnerability-vulnerability warning-the black bar safety net

Long time useless computer, recently busy Ah, just from the factory-do come back..... Just before this point of time on the Internet, ^^ looking for a source see directly the analogy recommended and download!!! phpscup enterprise built Station system v1. 8. 2 Analysis ing...... The online search...

WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection

WHMCompleteSolution WHMCS 5.2.8 - SQL Injection Exploit Title: WHMCS 5.2.8 SQL Injection Google Dork: "powered by WHMCS" Date: 10/18/2013 Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerab...

WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection

Exploit Title: WHMCS 5.2.8 SQL Injection Google Dork: "powered by WHMCS" Date: 10/18/2013 Exploit Author: g00n Xploiter.net Vendor Homepage: http://www.whmcs.com/ Software Link: http://www.whmcs.com/ Version: 5.2.8 Tested on: Windows, Linux Vulnerable file: /includes/dbfunctions.php POC:...

DEBIAN-CVE-2013-4368

The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information hypervisor stack content via unspecified vectors related to stale...

PT-2013-4976

Name of the Vulnerable Software and Affected Versions Xen versions 3.1.x through 4.3.x Description The issue allows local 64-bit PV guests to obtain sensitive information, specifically hypervisor stack content, via unspecified vectors related to stale data in a segment register. This occurs when...

CVE-2013-1442

Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain...

Design/Logic Flaw

Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain...

DEBIAN-CVE-2013-5634

arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service NULL pointer dereference, OOPS, and host OS crash or possibly have unspecified other impact by omitting vCPU initialization before a KVMGETREGLIST ioctl call...