5271 matches found
Unspecified Vulnerability in Oracle MySQL Server (CNVD-2015-00628)
MySQL is an open source relational database management system. A security vulnerability in Oracle MySQL's Server : Replication subcomponent allows remote attackers to exploit the vulnerability to affect the availability of the system...
openstack-neutron: Admin-only network attributes may be reset to defaults by non-privileged users
It was discovered that unprivileged users could in some cases reset admin-only network attributes to their default values. This could lead to unexpected behavior or in some cases result in a denial of service...
DEBIAN-CVE-2014-7154
Race condition in HVMOPtrackdirtyvram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors...
VTLS Virtua InfoStation.cgi - SQL Injection Vulnerability
VTLS-Virtua versions under 2014.X and all of 2013.2.X suffer from a remote SQL injection vulnerability. - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Othe...
VTLS Virtua InfoStation.cgi - SQL Injection
=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...
VTLS-Virtua SQL Injection
=====Alligator Security Team - Security Advisory============================ - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 - Author: José Tozo =====Table of Contents====================================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4...
Revive Adserver < 3.0.5 Multiple CSRF Vulnerabilities
According to its version number, the Revive Adserver install hosted on the remote web server is affected by multiple cross-site request forgery CSRF vulnerabilities. This can allow an attacker to delete data and cause service disruptions by enticing an authenticated user to follow a crafted URL...
wireshark: NFS dissector crash (wnpa-sec-2014-01)
The nfsnamesnoopaddname function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service memory corruption and application crash via a crafte...
CVE-2013-2818
The DNP Master Driver in Alstom e-terracontrol 3.5, 3.6, and 3.7 allows physically proximate attackers to cause a denial of service infinite loop and DNP3 service disruption via crafted input over a serial line...
Metasploit website Hacked just by sending a spoofed DNS change request via Fax to Domain Registrar
A group of Pro-Palestine hackers 'KDMS Team' today has been able to hijack the Metasploit website simply by sending a fax and hijacked their DNS records. Rapid7 is a leading Security Company and Creator of world's best penetration testing software called 'Metasploit'. The company confirmed via...
CVE-2013-3461
Cisco Unified Communications Manager Unified CM 8.5x and 8.6x before 8.62asu3 and 9.x before 9.11 does not properly restrict the rate of SIP packets, which allows remote attackers to cause a denial of service memory and CPU consumption, and service disruption via a flood of UDP packets to port...
MGASA-2013-0175 Updated subversion packages fix security vulnerabilities
Subversion repositories with the FSFS repository data store format can be corrupted by newline characters in filenames. A remote attacker with a malicious client could use this flaw to disrupt the service for other users using that repository CVE-2013-1968. Subversion's svnserve server process ma...
Wonderware Intelligence Tableau Server Ruby on Rails Improper Input Validation (Update A)
Overview This updated advisory was orignally posted to the US-CERT secure Portal library on February 5, 2013, and is now being released to the ICS-CERT Web page. Mitigation details for multiple vulnerabilities that impact third-party software integrated into the Invensys Wonderware Intelligence...
Service Disruption or Destruction: Which is Worse?
Outcomes in security tend to be about data loss; stolen pharmaceutical formulas, jet fighter blueprints, patient records, credit card numbers etc. All of these come with a great cost to the victim and make for sexy headlines. But far too little is dissected and analyzed about service disruptions...
Mozilla: Heap memory corruption issues found using Address Sanitizer (MFSA 2012-86)
Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service heap memory...
Twitter Denies Hacktivists Behind Severe Outage
Twitter officials say it was a “cascading bug” and not the handiwork of hacktivists that brought down the microblogging site today in two separate outages. “This wasn’t due to a hack or our new office or Euro 2012 or GIF avatars, as some have speculated today,” Mazen Rawashdeh, the company’s vice...
MySQL < 5.0.23 / 5.1.12 Denial of Service
The version of MySQL installed on the remote host is older than 5.0.23 or 5.1.12. As such, it reportedly is affected by an off-by-one buffer overflow. A local attacker could use this flaw to crash the service. Note that this vulnerability is disputed as the attacker needs extensive permissions to...
Hotmail, MSN, Office 365, live.com sites down (now up)
Hotmail , MSN , Office 365 , live.com sites down now up A number of Microsoft online services, including Hotmail, MSN, Office 365, and seemingly most if not all of .live.com addresses are currently "experiencing an outage". MSN and Office 365 have already tweeted about it: The downtime, which...
vBulletin 4.1.3pl3 / 4.1.4pl3 / 4.1.5pl1 Cross Site Scripting
Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Date published: 02-08-2011 Vendors contacted: vBulletin team Vulnerability Information Class: XSS flaw Vulnerable page: Admin Login Page admincp Remotely Exploitable: Yes Locally Exploitable: No Vulnerability Description...
