bind: TKEY query handling flaw leading to denial of service

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet...

USN-2693-1 bind9 vulnerabilities

Jonathan Foote discovered that Bind incorrectly handled certain TKEY queries. A remote attacker could use this issue with a specially crafted packet to cause Bind to crash, resulting in a denial of service. CVE-2015-5477 Pories Ediansyah discovered that Bind incorrectly handled certain...

Microsoft Windows DNS Server Spoofing - Ver2 (CVE-2007-3898)

There exits a vulnerability in Microsoft Windows DNS Server. The flaw is caused by predictable transaction identifiers in DNS requests generated. A remote attacker may leverage this vulnerability to use spoofed DNS responses to poison the DNS cache on the target system...

Job reports warning "Failed to truncate transaction logs for SQL instances: Possible reasons: lack of permissions, or transaction log corruption."

Challenge Backup Job with Application-Aware Processing enabled and configured to "process transaction logs" displays the warning: Failed to truncate Microsoft SQL Server transaction logs. Details: Failed to process 'TruncateSQLLog' command. Failed to truncate SQL server transaction logs for...

Shopify: Payment gateway status transferred to Shopify without authentication

Note: This issue was originally reported to our self-hosted bug bounty program, and was transferred to HackerOne. One of the third-party payment gateways that can be used with Shopify did not offer a secure means of reporting transaction status to Shopify. As a result, it was possible for an...

Microsoft patch day 2015-4-14: the repair of many high-risk IE, Windows, Office vulnerabilities-vulnerability warning-the black bar safety net

Monthly the second Tuesday, Microsoft fixed the patch to fix the day, Microsoft on Tuesday（2015-4-14 the“patch day”on repairing a large number of vulnerabilities, which includes many IE, Windows, Office, high-risk vulnerabilities. Update announcement MS15-0 3 4 announcement MS15-0 3 4 announcemen...

FreeBSD zfs weak permissions

Weak file permissions may be set during transaction replay...

SAP Internet Transaction Server Information Disclosure - Ver2 (CVE-2003-0747)

An information disclosure vulnerability has been reported in Sap Internet Transaction Server. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

CVE-2015-0274: Undefined Security Weakness

The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service transaction overrun and data corruption or possibly gain privileges by leveraging XFS filesystem access...

IBM Tivoli Storage Manager Backup-Archive client authentication bypass vulnerability

IBM Tivoli Storage Manager TSM is a suite of backup and recovery management solutions from IBM in the U.S. It supports data protection, space management and archiving, business recovery, and disaster recovery.IBM TSM Backup-Archive Client is one of the backup archive clients. A security...

subversion: NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names

A NULL pointer dereference flaw was found in the way the moddavsvn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing moddavsvn to crash...

Mandriva Linux Security Advisory : subversion (MDVSA-2015:005)

Updated subversion packages fix security vulnerabilities : A NULL pointer dereference flaw was found in the way moddavsvn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash moddavsvn CVE-2014-3580. A NULL pointer dereference flaw was found in t...

Enter: stored xss in transaction

Open wallet settings and remove maxlength="30" from wallet name input 2. Change name to something like this asdf'"alert1 3. Go to "Send bitcoin" and make inbound transfer from one wallet to another with description: descalert'xss in description' 4. Submit form 5. After submit we got xss both in...

DEBIAN-CVE-2014-8108

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a request for a URI that triggers a lookup for a virtual transaction name that does not exist...

Null pointer dereference

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a request for a URI that triggers a lookup for a virtual transaction name that does not exist...

CVE-2014-8108: Undefined Security Weakness

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a request for a URI that triggers a lookup for a virtual transaction name that does not exist...

CVE-2014-8108

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a request for a URI that triggers a lookup for a virtual transaction name that does not exist...

UBUNTU-CVE-2014-8108

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a request for a URI that triggers a lookup for a virtual transaction name that does not exist...

Square: Delayed, fraudulent transactions possible with encrypted Square Reader devices due to lack of server-side verification of device transaction counter

Although Square Readers implement encryption, possibly with a Derived Unique Key Per Transaction DUKPT scheme, the transaction counter of a Square Reader device is not verified when performing server-side decryption of swipe data. During a valid sale, a malicious merchant or third party can recor...

CVE-2014-7842

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service guest OS crash via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to...