5085 matches found
CVE-2014-7842
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service guest OS crash via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to...
PayPal MultiOrder Shipping Cross Site Scripting
Document Title: =============== PayPal Inc BugBounty 107 MultiOrder Shipping API - Persistent History Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1048 PayPal Security UID: dq115aYq Release Date: ============= 2014-10-27 Vulnerability...
uIP and lwIP DNS resolver vulnerable to cache poisoning
Overview The DNS resolver implemented in uIP and lwIP is vulnerable to cache poisoning due to non-randomized transaction IDs TXIDs and source port reuse. Description CWE-330: Use of Insufficiently Random Values - CVE-2014-4883The DNS resolver implemented in all versions of uIP, as well as lwIP...
Oracle Business Transaction Management Detection
Binary data oraclebusinesstransactionmanagementdetect.nbin...
Oracle Business Transaction Management 'FlashTunnelService' 'WriteToFile' Message RCE
The remote web server is hosting a version of Oracle Business Transaction Management that is affected by a remote code execution vulnerability. The 'FlashTunnelService' web service does not require authentication and exposes the 'WriteToFile' function, which can allow a remote, unauthenticated...
kernel: powerpc: tm: crash when forking inside a transaction
A flaw was found in the way the Linux kernel performed forking inside of a transaction. A local, unprivileged user on a PowerPC system that supports transactional memory could use this flaw to crash the system...
phpCoupon Remote Payment Bypass Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/25116/info phpCoupon is prone to a remote payment-bypass vulnerability because the application fails to properly secure PayPal payment transactions. Successfully exploiting this issue allows remote attackers to perform...
SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String Javascript Splicing XSS
No description provided by source. source: http://www.securityfocus.com/bid/29103/info SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to...
sap internet transaction server 4620.2.0.323011 build 46b.323011 - Directory Traversal file disclosure vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8516/info SAP is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of sensitive files. The problem occurs due to the application failing to parse user-supplied...
Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService Remote File Deletion
No description provided by source. Oracle Business Transaction Management Server 12.1.0.2.7 FlashTunnelService Remote File Deletion tested against: Microsoft Windows Server 2003 r2 sp2 Oracle WebLogic Server 12c 12.1.1 Oracle Business Transaction Management Server 12.1.0.2.7 Production version...
Microsoft Windows KTM Invalid Free with Reused Transaction GUID (MS10-047)
No description provided by source. Microsoft Windows KTM Invalid Free with reused transaction GUID ---------------------------------------------------------------------------- CVE-2010-1889 The Kernel Transaction Manager ktm was introduced in Windows Vista and has been included in subsequent...
SAP Internet Transaction Server 6200.1017.50954.0 - Bu WGate wgate.dll ~service Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/29103/info SAP Internet Transaction Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to...
SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8515/info A vulnerability has been discovered in SAP Internet Transaction Server SITSthat could allow an attacker to obtain sensitive information. The problem occurs due to SITS disclosing sensitive local filesystem...
SAP Internet Transaction Server 6.10/6.20 Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/20244/info SAP Internet Transaction Server ITS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue would allow an attacker to steal...
CiviCRM 3.1 < Beta 5 Multiple XSS Vulnerabilities
No description provided by source. Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: 3.1 Beta 5, Tested on 3.1 Beta 1 Tested on: BT4 pre-final Greetz ...
Oracle Business Transaction Management FlashTunnelService Remote Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
CVE-2014-1383: Undefined Security Weakness
Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors...
SAP Internet Transaction Server 4620.2.0.323011 Build 46B.323011 Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/8517/info The 'wgate.dll' componenet of SAP Internet Transaction Server has been reported prone to cross-site scripting attacks. The issue occurs due to a lack of sufficient sanitization performed on data supplied to the...
Cross site request forgery (csrf)
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service deadlock by terminating a subscription request before it is complete, which triggers a SIP transaction timeout...
CVE-2014-4048
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service deadlock by terminating a subscription request before it is complete, which triggers a SIP transaction timeout...