USN-2839-1 cups update

As a security improvement against the POODLE attack, this update disables SSLv3 support in the CUPS web interface. For legacy environments where SSLv3 support is still required, it can be re-enabled by adding "SSLOptions AllowSSL3" to /etc/cups/cupsd.conf...

Google Releases Security Update for Chrome

Google has released Chrome version 47.0.2526.106 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. Users and administrators are encouraged to review the Chrome Releases...

ManageEngine OpManager SubmitQuery IntegrationUser SQL Code Execution (CVE-2015-7765; CVE-2015-7766)

An SQL code execution vulnerability exists in ManageEngine OpManager. By sending crafted requests to an affected server, a remote attacker can exploit this vulnerability to execute arbitrary SQL commands with Administrator privileges which can further lead to arbitrary code execution in the...

sssd: memory leak in the sssd_pac_plugin

It was found that SSSD's Privilege Attribute Certificate PAC responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon...

sssd: memory leak in the sssd_pac_plugin

It was found that SSSD's Privilege Attribute Certificate PAC responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon...

xen-kernel -- leak of main per-domain vcpu pointer array

The Xen Project reports: A domain's primary array of vcpu pointers can be allocated by a toolstack exactly once in the lifetime of a domain via the XENDOMCTLmaxvcpus hypercall. This array is leaked on domain teardown. This memory leak could -- over time -- exhaust the host's memory. A domain give...

flashplugin: arbitrary code execution

Several critical type confusion vulnerabilities CVE-2015-7645, CVE-2015-7647, CVE-2015-7648 have been identified in Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected...

Amazon Web Services Inspector Application Security Scanner

Amazon answered many security and compliance prayers yesterday with the release of its Inspector tool. Inspector scans applications launched in Amazon Web Services instances, looking for issues on two fronts: compliance with certain regulations such as the Payment Card Industry Data Security...

LOYTEC Router Information Exposure Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified a password file vulnerability in LOYTEC’s LIP-3ECTB routers. LOYTEC has produced a firmware update to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following LOYTEC routers are affected:...

Page2Flip 2.5 Missing Access Control

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-033 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Versions: Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Versions: Premium App 2.5 Vulnerability Type: Missing Function Leve...

The Mac OS X operating system, and found 2 pieces of Privilege elevation 0day vulnerabilities-vulnerability warning-the black bar safety net

Apple Mac OS X operating system, and found 2 pieces new, 0day vulnerabilities, if an attacker successfully exploited, may be in the victim's equipment on elevated privileges to get root access. Vulnerability details These two vulnerabilities is by Italian security researcher Luca Todesco found, a...

某论文系统三处注入打包(全部提交)

简要描述： rt 详细说明： rt 漏洞证明： 谷歌搜索：论文授权提交系统 第一处: http://202.120.121.200/tasi/admin/convert/convert.asp?action=querylist http://202.195.243.37/tasi/admin/convert/convert.asp?action=querylist http://202.116.50.25/tasi/admin/convert/convert.asp?action=querylist...

Unspecified Vulnerability in Oracle Fusion Oracle Endeca Information Discovery Studio Component (CNVD-2015-04745)

Oracle Fusion Middleware is a suite of application servers for cloud and traditional environments. A security vulnerability exists in the Oracle Fusion Middleware Oracle Endeca Information Discovery Studio component that can be exploited by remote attackers to compromise system integrity,...

Cross-site Scripting Vulnerability in Panavision OA Office System

Panavision OA Office System is a coordination office software. A cross-site scripting vulnerability exists in Panmicro OA Office System, which allows attackers to exploit the vulnerability to perform cross-site scripting attacks...

[SECURITY] Fedora 22 Update: pam-1.1.8-19.fc22

PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the accessibility of protected information

The multiple vulnerabilities in the openssl-1.0.1e package of the Red Hat Enterprise Linux operating system can lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability

A vulnerability in the web-based user interface of Cisco Unified MeetingPlace could allow an authenticated, remote attacker to gain read access to select information stored on the affected system. The vulnerability is due to improper handling of XML External Entities XXEs when parsing an XML file...

Eraseme Backdoor analysis-vulnerability warning-the black bar safety net

0×0 0 summary This is@neteagle capture a sample of this, curious to ask to come and see, a simple analysis for a moment; this is one with the infection function of backdoors. Due to its propagation name eraseme%d%d%d%d%d.exe so we called Eraseme the back door. This is my first analysis report,...

Win Free Air Miles for Finding Security Flaws in United Airlines

If you are a security researcher and fond of traveling from one conference to another, then United Airlines' bug bounty program would be of great interest for you. United Airlines has launched a new bug bounty program inviting security researchers and bug hunters to report vulnerabilities in its...

[SECURITY] Fedora 21 Update: netcf-0.2.8-1.fc21

Netcf is a library used to modify the network configuration of a system. Network configurations are expressed in a platform-independent XML format, which netcf translates into changes to the system's 'native' network configuration files...