Microsoft Windows Library Loading CVE-2015-6132 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition. Technologies Affected Microsoft...

Microsoft Silverlight CVE-2015-6114 Information Disclosure Vulnerability

Description Microsoft Silverlight is prone to an information-disclosure vulnerability. Successful exploits will allow attackers to gain access to potentially sensitive information that may aid in further attacks. Technologies Affected Microsoft Silverlight 5 Developer Runtime Microsoft Silverligh...

TECO SG2 LAD Client 3.51 SEH Overwrite Buffer Overflow Exploit

Summary SG2 Client is a program that enables to create and edit applications. The program is providing two edit modes, LADDER and FBD to rapidly and directly input the required app. The Simulation Mode allows users to virtually run and test the program before it is loaded to the controller...

MGASA-2015-0444 Updated flash-player-plugin packages fix security vulnerability

Adobe Flash Player 11.2.202.548 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves a type confusion vulnerability that could lead to code execution CVE-2015-7659. This...

The vulnerability of the Oracle E-Business Suite system’s automation activities allows a perpetrator to gain access to the operating system or execute arbitrary code with administrator privileges.

The vulnerability of the Oracle Applications Technology Stack component in the Oracle E-Business Suite automation system is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with administrator privileges remotely...

CVE-2007-2844

PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access...

Solarwinds Storage Manager ProcessFileUpload.jsp File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Solarwinds Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within ProcessFileUpload.jsp within the handling of file uploads. The issue lies i...

Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description Mango suffers from an...

Mango Automation 2.6.0 CSRF Arbitrary Command Execution Exploit

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The POST parameter 'c0-param0...

Arbitrary file manipulation by local user through Mozilla updater — Mozilla

Security researcher Holger Fuhrmannek reported that when the Mozilla updater is run, the updater can be manipulated to load the updated files from a working directory under user control in concert with junctions. When the updates are run by the Mozilla Maintenance Service on Windows, these...

GE MDS PulseNET Hidden Support Account Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE MDS PulseNET. Authentication is required to exploit this vulnerability but it can bypassed using static credentials. The specific flaw exists within the PulseNET web service. It contains a hidde...

Android Stagefright Exploit Code Released to Public

Joshua Drake, the researcher who found the so-called Stagefright vulnerability in Android, today released exploit code to the public, which he hopes will be used to test systems’ exposure to the flaw. The move comes more than a month after vulnerability details were released in August during...

The vulnerability of the iOS operating system, which allows a hacker to circumvent access restrictions to file system objects

The vulnerability of the AppleFileConduit component in the iOS operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass access restrictions to file system objects by manipulating symbolic links...

SOL17245 - Linux kernel vulnerability CVE-2014-9584

Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...

Apple iOS AirTraffic Directory Traversal Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS AirTraffic, which allows malicious applications to exploit the vulnerability to access protected portions of the file system...

Apple iOS Backup Symbolic Link Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A symbolic link vulnerability exists in Apple iOS Backup, which allows malicious applications to exploit the vulnerability to access protected portions of the file system...

up.time 7.5.0 Upload And Execute File Exploit

Summary The next-generation of IT monitoring software. Description up.time suffers from arbitrary command execution. Attackers can exploit this issue using the monitor service feature and adding a command with respected arguments to given binary for execution. In combination with the CSRF,...

(Pwn2Own) Microsoft Windows TrueType Font Pool Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing...

IBM Tivoli Storage Manager FastBack Server Opcode 1365 Volumes Restore Agents Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of opcode 1365. By sending a crafted packet on TCP...

Scientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. CVE-2015-4024 An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP...