Lenovo System Update < 5.06.0034 Multiple Vulnerabilities

The version of Lenovo System Update installed on the remote host is prior to 5.06.0034. It is, therefore, affected by the following vulnerabilities : - A flaw exists in SUService.exe System Update service due to generating security tokens for a named pipe in a predictable manner. A local attacker...

Race condition

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2233

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

PT-2015-5676

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description The issue arises from improper validation of CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files using a crafted...

CVE-2015-2233: Undefined Security Weakness

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

Ubuntu 14.04 LTS : dpkg vulnerability (USN-2566-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2566-1 advisory. Jann Horn discovered that dpkg incorrectly validated signatures when extracting local source packages. If a user or an automated system were tricked into unpackin...

CVE-2014-4494

Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a...

PT-2015-3757

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3 Description The issue concerns the Springboard component in Apple iOS, which fails to properly validate signatures. This allows attackers to bypass intended restrictions on the first launch of an app by using ...

[SECURITY] [DSA 3129-1] rpm security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3129-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 15, 2015 http://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3129-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Race condition

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory...

CVE-2013-6435

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory...

CVE-2013-6435

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory...

CVE-2013-6435

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory...

CVE-2013-6435

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory...

TinyShop SQL注入一枚

简要描述： 20140926 详细说明： 这次这个还是在payment里，是异步callback时候，有类似问题，其实我不想分开交的，其实不想分开交，怕有重复过不了。 /protected/controllers/payment.php中 asynccallback function asynccallback //从URL中获取支付方式 $paymentid = Filter::intReq::get'paymentid'; $payment = new Payment$paymentid; $paymentPlugin = $payment-getPaymentPlugin;...

DEBIAN-CVE-2014-0490

The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package...

CVE-2014-0490

The CVE-2014-0490 issue affects APT’s download path prior to version 1.0.9, where apt-get download did not properly validate package signatures. This allows a crafted package to potentially execute arbitrary code on affected systems. Public advisories document the vulnerability in several distrib...

CVE-2014-0490

The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package...

[USN-2348-1] APT vulnerabilities

========================================================================== Ubuntu Security Notice USN-2348-1 September 16, 2014 apt vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...