PT-2014-5288 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: A issue in the SSL VPN implementation allows remote attackers to obtain potentially sensitive software-version information by reading the verbose...

USN-2347-1 python-django vulnerabilities

Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. CVE-2014-0480 David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume...

conga: Multiple information leak flaws in various luci site extensions

Multiple information leak flaws were found in the way conga processed luci site extension-related URL requests. A remote, unauthenticated attacker could issue a specially crafted HTTP request that, when processed, would result in unauthorized information disclosure...

(Plone): Partial denial of service through Collections functionality

It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive I/O and/or cache resource consumption...

(Plone): Partial denial of service through internal function

It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values passed to an internal utility function. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive memory consumption...

PT-2014-4129 · Apple · Safari +1

Name of the Vulnerable Software and Affected Versions: Safari in Apple iOS versions prior to 7.1.2 Description: The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash. This can b...

PT-2014-5485 · D Link · D-Link Dap 1150

Name of the Vulnerable Software and Affected Versions: D-Link DAP 1150 version 1.2.94 Description: The issue allows remote attackers to hijack the authentication of administrators for various requests, including enabling or disabling the DMZ in the Firewall/DMZ section via a request to "index.cgi...

PT-2014-4538 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Description: The issue allows remote authenticated users to read files by sending a crafted URL to the HTTP server, potentially accessing sensitive information suc...

python-django: unexpected code execution using reverse()

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."...

Redmine vulnerable to open redirect

Overview Redmine is a project management software. Redmine contains an open redirect vulnerability due to insufficient checking of the URL parameter. Minoru Sakai of SCSK Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

libyaml: heap-based buffer overflow when parsing URLs

A heap based buffer overflow exists in the libyaml package such that an attacker by supplying a specially crafted yaml document when parsed by the application might result in remote code execution leading to complete compromise of the system...

CVE-2011-3344

A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting XSS vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session...

大汉网络又来几处命令执行漏洞

简要描述： RT 详细说明： 存在漏洞的地址： http://demo.hanweb.com/jact/front/frontreg.action http://demo.hanweb.com/jact/front/frontmailstat.action http://demo.hanweb.com/jact/front/frontmailwrite.action 直接谷歌：site:hanweb.com filetype:action 一堆是... 证明： http://demo.hanweb.com/jact/1.txt 漏洞证明：...

Reserve Bank of Australia Hacked by Chinese malware

If hackers want to get into your computer network, they will find a way. You can make it harder but you can't stop them. According to Australian Financial Review report on Monday, the Reserve Bank of Australia RBA was hacked by hackers who infiltrated its networks and allegedly stole information...

DEBIAN-CVE-2011-4612

icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc error.log via a crafted URL...

Millions of DSL modems hacked in Brazil, spread banking malware

More than 4.5 million DSL modems have been compromised as part of a sustained hacking campaign in Brazil, with the devices spreading malware and malicious web address redirects. According to the malware analyst at Kaspersky Lab in Brazil, Fabio Assolini. The vulnerability exploited by attackers...

Certain URL constructs can allow arbitrary code execution – Opera Security Advisories

Certain page address URL constructs can cause Opera to allocate the wrong amount of memory for storing the address. When it then attempts to store the address, it will overwrite unrelated memory with attacker-controlled data. This can lead to a crash, which may also execute that data as code...

CVE-2012-1465

Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service application crash via a long URL in an HTTP request. NOTE: some of these details are obtained from third party information...

plone: A reflected cross site scripting vulnerability

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2011-5079

Open redirect vulnerability in the Modern FAQ irfaq extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."...