1839 matches found
Threat Outbreak Alert: Email Messages with Malicious Attachments on March 31, 2014
Medium Alert ID: 33580 First Published: 2014 March 31 17:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that contain an attachment for the recipient. The email message attempts to convince the recipient to open the attachment for details...
Threat Outbreak Alert: Email Messages with Malicious Links on March 11, 2014
Medium Alert ID: 33266 First Published: 2014 March 11 16:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a malicious link for the recipient. The text in the email message attempts to convince the...
Threat Outbreak Alert: Fake Bill Payment Notification Email Messages on April 22, 2014
Medium Alert ID: 33025 First Published: 2014 February 25 20:37 GMT Last Updated: 2014 April 24 13:31 GMT Version: 2 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain bill payment notification for the recipient. The text i...
Bandizip 3.09 Crash Proof Of Concept
!/usr/bin/env ruby Exploit Title: Bandizip 3.09 .zip Crash POC Date: February 6th 2014 Author: Osanda Malith Jayathissa E-Mail: osandajayathissagmail.com Version: 3.09 32bit and 64bit Below versions might be affected Vendor Homepage: http://www.bandisoft.com/ Tested on: Windows XP 32-bit SP2 en,...
Directory traversal
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. dot dot sequences in a zip file...
CVE-2011-2725
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. dot dot sequences in a zip file...
CVE-2011-2725
CVE-2011-2725 is a directory traversal vulnerability in Ark 4.7.x and earlier. A malicious zip file containing ".." sequences can cause remote attackers to delete or force the display of arbitrary files. Several advisories reference an Ark path traversal vulnerability (ARK) and cite the same CVE,...
CVE-2013-6795
The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...
Design/Logic Flaw
The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...
CVE-2013-6795
The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...
Threat Outbreak Alert: Fake Fund Transfer Notification Email Messages on December 5, 2013
Medium Alert ID: 32058 First Published: 2013 December 6 15:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain payment transfer details for the recipient. The text in the e-mail message attempts to...
Google Android - Signature Verification Security Bypass
Google Android - Signature Verification Security Bypass source: https://www.securityfocus.com/bid/63547/info Google Android is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in furthe...
Threat Outbreak Alert: Fake Online Gambling Bonus Offer Email Messages on September 10, 2013
Medium Alert ID: 30738 First Published: 2013 September 11 14:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain bonus offers for the recipient. The text in the email message instructs the recipient to...
Android ZIP文件提取classes.dex文件签名校验绕过漏洞
Google Android是一种以Linux为基础的开放源代码操作系统，主要使用于便携设备 Google Android在签名验证过程中，对Zip文件相应16位域的读取时，没有考虑到大于2^15的情况。通过构建特殊的classes.dex，可绕过签名校验，安装恶意程序 0 Google Android 4.2 厂商解决方案 目前没有详细解决方案提供： http://www.android.com/...
Security feature bypass
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature, probably involving multiple...
CVE-2013-4787
Android 1.6–4.2 (Donut to Jelly Bean) contains a flaw in verifying APK cryptographic signatures: an APK.modified file with duplicate Zip entries may be installed despite one entry being validated, enabling arbitrary code execution via the Master Key vulnerability. The issue arises from inconsiste...
Threat Outbreak Alert: Fake Invoice Attachment Email Messages on July 5, 2013
Medium Alert ID: 29943 First Published: 2013 July 3 18:36 GMT Last Updated: 2013 July 5 17:02 GMT Version: 2 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain an invoice attachment for the recipient. The text in the email...
tipask 2.0 后台任意代码执行
简要描述： Tipask问答系统是一款开放源码的PHP仿百度知道程序。以国人的使用习惯为设计理念，采用MVC构架，系统具有速度快，SEO友好，界面操作简洁明快等特点。 但是Tipask后台中存在问题，所以导致进入后台的用户可以执行任意代码。 详细说明： 在control/admin/db.php onimport函数中 /数据库导入/ function onimport settimelimit0; ifsubstrtriminiget'memorylimit',0,-10 @iniset'memorylimit','32M';...
BitZipper 2013 < 2013 Update 1 Memory Corruption Vulnerability
The version of BitZipper is 2013 prior to update 1 2013.13.4.16. As such, it is affected by a memory corruption vulnerability triggered when handling a crafted ZIP file. An attacker could exploit this issue by tricking a user into opening a specially crafted ZIP file, resulting in arbitrary code...
