Cisco OpenH264 Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on applications using vulnerable versions of Cisco OpenH264. The specific flaw exists within the decoder logic. By providing malformed H.264 data to the decoder, an attacker can force a dangling pointer to be referenced after it...

Cisco OpenH264 Heap Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on applications using vulnerable versions of Cisco OpenH264. The specific flaw exists within the decoder logic. By providing malformed H.264 data to the decoder, an attacker can overwrite a heap buffer. This could result in the...

IBM Fixes Serious Code Execution Bug in Endpoint Manager Product

IBM has fixed a serious vulnerability in its Endpoint Manager product that could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The vulnerability lies in the Endpoint Manager for Mobile Devices component of the product and the researchers who discovered...

SUSE-SU-2015:1177-1 Security update for MySQL

This MySQL update provides the following: upgrade to version 5.5.39, bnc887580 CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260, CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233, CVE-2014-4240, CVE-2014-4214, CVE-2014-4243 See also:...

MGASA-2014-0321 Updated eet packages fix security vulnerability

Integer overflow in the LZ4 algorithm implementation on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an AP...

[security bulletin] HPSBHF02913 rev.1 - HP Intelligent Management Center (iMC) and HP Branch Intelligent Management System (BIMS), Remote Disclosure of Information

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04369484 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04369484 Version: 1 HPSBHF02913 rev....

Cisco Patches XSS Flaw in Security Appliances

There’s a reflected cross-site scripting vulnerability in a variety of Cisco security appliances that enables a remote, unauthenticated attacker to execute arbitrary code in the context of the user. The vulnerability affects the Cisco Email Security Appliance, the Cisco Web Security Appliance and...

Threat Outbreak Alert: Fake Security Software Patch Email Messages on May 20, 2014

Medium Alert ID: 34300 First Published: 2014 May 20 15:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a security software program for the recipient. The text in the email message attempts to convince the recipient to...

SRTT Vulnerability in BIND Software Puts DNS Protocol Security At Risk

After the Heartbleed bug that exposed half of the Internet vulnerable to hackers thereby marking as one of the largest Internet vulnerability in recent history, the critical flaw in the implementation of the DNS protocol could also represent a serious menace to the Internet security. A Serious...

[security bulletin] HPSBMU02971 rev.1 - HP Application Information Optimizer, Remote Execution of Code, Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04140965 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04140965 Version: 1 HPSBMU02971 rev....

MGASA-2014-0067 Updated mpg123 packages fix a buffer overflow

Updated mpg123 packages fix security vulnerability: mpg123 1.14.1 and later are vulnerable to a buffer overflow that could allow a maliciously crafted audio file to crash applications that use the libmpg123 library. mpg123 has been updated to version 1.18.0, which fixes this issue, as well as...

MGASA-2013-0339 Updated memcached packages fix CVE-2011-4971

Updated memcached packages fix security vulnerability: Memcached is vulnerable to a denial of service as it can be made to crash when it receives a specially crafted packet over the network CVE-2011-4971. The updated packages have been upgraded to the 1.4.15 version and patched to resolve this fl...

Oracle Java multiple security vulnerabilities

40 different vulnerabilities...

Easy to buy program SQL injection vulnerability-vulnerability warning-the black bar safety net

Easy to buy management system is a positioning high-end market group buying content management system,to the lowest cost,minimal human input in the shortest time to set up a fully functional, excellent performance, huge size and easy to maintain website platform. Not filtered lead injection ! ! T...

Google sets 7 Day deadline For vulnerability disclosure

Google will release details of any zero-day flaws it finds in software, if the affected vendor fails to issue a patch or disclose the issue itself within a week. Now, Google is shortening that timeline a good bit to just 7 days. “Based on our experience...we believe that more urgent action within...

Microsoft Internet Explorer CVE-2013-0091 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Cisco VoIP phone vulnerability allow eavesdropping remotely

Cui, a fifth year grad student from the Columbia University Intrusion Detection Systems Lab and co-founder of Red Balloon Security, has demonstrated an attack on common Cisco-branded Voice over IP VoIP phones that could easily eavesdrop on private conversations remotely. The vulnerability Cui...

Cisco VoIP phone vulnerability allow eavesdropping remotely

Cui, a fifth year grad student from the Columbia University Intrusion Detection Systems Lab and co-founder of Red Balloon Security, has demonstrated an attack on common Cisco-branded Voice over IP VoIP phones that could easily eavesdrop on private conversations remotely. The vulnerability Cui...

Python不安全文件权限漏洞

BUGTRAQ ID: 55882 Python是一种面向对象、直译式计算机程序设计语言。 Python 3.3.0及其他版本的安装目录存在不安全文件权限漏洞，本地攻击者可利用此漏洞以提升的权限执行任意代码。 0 python 3.x 厂商补丁： Python ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： www.python.org...

MyBB 1.6.8 'announcements.php'远程SQL注入漏洞

BUGTRAQ ID: 54130 MyBB是一款流行的Web论坛程序。 MyBB 1.6.8没有正确过滤用户提供的输入即用在SQL查询中，导致攻击者利用此漏洞控制应用、访问或修改数据或利用下层数据库中的其他漏洞。 0 MyBB 1.6.8 厂商补丁： MyBB ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/...