Debian DLA-913-1 : activemq security update

It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 'Wheezy', these problems have been fixed in version 5.6.0+dfsg-1+deb7u3. We recommend that you upgrade your...

[SECURITY] [DLA 913-1] activemq security update

Package : activemq Version : 5.6.0+dfsg-1+deb7u3 CVE ID : CVE-2015-7559 Debian Bug : 860866 It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 "Wheezy", these...

Chrome Universal XSS using late widget updates (CVE-2017-5006)

VULNERABILITY DETAILS Among the things that Document::shutdown does, |view-dispose| is called: From /thirdparty/WebKit/Source/core/frame/FrameView.cpp: void FrameView::dispose ... // FIXME: Do we need to do something here for OOPI? HTMLFrameOwnerElement ownerElement = mframe-deprecatedLocalOwner;...

Liebert MultiLink Automated Shutdown Elevation of Privilege Vulnerability

Liebert MultiLink Automated Shutdown is a set of programs used in Liebert UPS systems to prevent automatic server shutdown. A security vulnerability exists in Liebert MultiLink Automated Shutdown version 4.2.4. A local attacker can exploit this vulnerability by replacing the LiebertM executable...

CVE-2015-7559

It was found that the Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...

CVE-2015-7260

Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file...

CVE-2015-7260

Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file...

Design Flaw Vulnerability in Tencent PC Butler's Synchronized Objects for Marking Protection Status

Tencent PC Manager Tencent PC Manager/formerly known as QQ PC Manager is a free security software from Tencent. A design flaw exists in the synchronization object used by Tencent PC Manager to mark the protection state, which is caused by not properly setting the access control of the...

ActiveMQ: DoS in client via shutdown command

It was found that the Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client...

Apache 2.2 - Scoreboard Invalid Free On Shutdown Vulnerability

Exploit for linux platform in category dos / poc Source: http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/ Introduction Apache 2.2 webservers may use a shared memory segment to share child process status information scoreboard between the child processes and the parent...

CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1 (and Cloudera CDH 5.0.x before 5.0.2) fail to check authorization for HDFS admin commands refreshNamenodes, deleteBlockPool, and shutdownDatanode. This allows remote authenticated users to cause DataNodes to shut down or perform unnecessary...

Unauthorized Container Shutdown In ServerMigrationCoordinator

Application: Oracle PeopleSoft Versions Affected: PeopleSoft FSCM 9.2 Vendor: Oracle Bug: Missing Authentication for Critical Function Reported: 16.03.2017 Vendor response: 17.03.2017 Date of Public Advisory: 18.07.2017 Reference: Oracle CPU July 2017 Authors: Vahagn Vardanyan ERPScan VULNERABILI...

BrainDamage - A fully featured backdoor that uses Telegram as a C&C server

A python based backdoor which uses Telegram as C&C server. /\ /.\ ,.-'/ ",'-., -^ /-^: | \ | \ | | | | | | | | Coded by: Mehul [email protected] -- Github: https://github.com/mehulj94 -- Twitter: https://twitter.com/wayfarermj -- For windows only | | | | | | | | | / / | | | | | '/ / |...

CVE-2017-5419

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service DOS attack. This vulnerability affects Firefox 52 and Thunderbird 52...

CVE-2016-4315

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...

CVE-2016-4315

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...

CVE-2016-4315

CVE-2016-4315 describes a Cross-Site Request Forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 . The issue enables an attacker to hijack the authentication of privileged users and trigger a shutdown action via requests to server-admin/proxy_ajaxprocessor.jsp. Documented impact in sources: CSRF wi...

CVE-2016-4315

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploitation could lead to arbitrary code execution...