CVE-2013-6795

The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...

Design/Logic Flaw

The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...

CVE-2013-6795

The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984, which triggers the download and extraction of a ZIP file that overwrites the Agent service binary...

Threat Outbreak Alert: Fake Fund Transfer Notification Email Messages on December 5, 2013

Medium Alert ID: 32058 First Published: 2013 December 6 15:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain payment transfer details for the recipient. The text in the e-mail message attempts to...

Google Android - Signature Verification Security Bypass

Google Android - Signature Verification Security Bypass source: https://www.securityfocus.com/bid/63547/info Google Android is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in furthe...

Threat Outbreak Alert: Fake Online Gambling Bonus Offer Email Messages on September 10, 2013

Medium Alert ID: 30738 First Published: 2013 September 11 14:48 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain bonus offers for the recipient. The text in the email message instructs the recipient to...

Android ZIP文件提取classes.dex文件签名校验绕过漏洞

Google Android是一种以Linux为基础的开放源代码操作系统，主要使用于便携设备 Google Android在签名验证过程中，对Zip文件相应16位域的读取时，没有考虑到大于2^15的情况。通过构建特殊的classes.dex，可绕过签名校验，安装恶意程序 0 Google Android 4.2 厂商解决方案 目前没有详细解决方案提供： http://www.android.com/...

Security feature bypass

Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature, probably involving multiple...

CVE-2013-4787

Android 1.6–4.2 (Donut to Jelly Bean) contains a flaw in verifying APK cryptographic signatures: an APK.modified file with duplicate Zip entries may be installed despite one entry being validated, enabling arbitrary code execution via the Master Key vulnerability. The issue arises from inconsiste...

Threat Outbreak Alert: Fake Invoice Attachment Email Messages on July 5, 2013

Medium Alert ID: 29943 First Published: 2013 July 3 18:36 GMT Last Updated: 2013 July 5 17:02 GMT Version: 2 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain an invoice attachment for the recipient. The text in the email...

tipask 2.0 后台任意代码执行

简要描述： Tipask问答系统是一款开放源码的PHP仿百度知道程序。以国人的使用习惯为设计理念，采用MVC构架，系统具有速度快，SEO友好，界面操作简洁明快等特点。 但是Tipask后台中存在问题，所以导致进入后台的用户可以执行任意代码。 详细说明： 在control/admin/db.php onimport函数中 /数据库导入/ function onimport settimelimit0; ifsubstrtriminiget'memorylimit',0,-10 @iniset'memorylimit','32M';...

BitZipper 2013 < 2013 Update 1 Memory Corruption Vulnerability

The version of BitZipper is 2013 prior to update 1 2013.13.4.16. As such, it is affected by a memory corruption vulnerability triggered when handling a crafted ZIP file. An attacker could exploit this issue by tricking a user into opening a specially crafted ZIP file, resulting in arbitrary code...

libarchive integer overflow

Integer overflow on zip file creation leads to buffer overflow...

Path traversal in HtmlExporter.java and FileXmlExporter.java

Both HtmlExporter.java and FileXmlExporter.java use the prepareExportFileName method inherited from AbstractExporterImpl.java|https://stash.atlassian.com/projects/CONF/repos/confluence/browse/confluence-core/confluence/src/java/com/atlassian/confluence/importexport/impl/AbstractExporterImpl.java9...

Reserve Bank of Australia Hacked by Chinese malware

If hackers want to get into your computer network, they will find a way. You can make it harder but you can't stop them. According to Australian Financial Review report on Monday, the Reserve Bank of Australia RBA was hacked by hackers who infiltrated its networks and allegedly stole information...

ChillyCMS 1.3.0 - Multiple Vulnerabilities

ChillyCMS 1.3.0 - Multiple Vulnerabilities Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: "powered by chillyCMS" Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link:...

Code execution in /lib/migrate.php - ownCloud

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows authenticated remote attackers to execute arbitrary code by uploading a crafted mount.php file in an imported ZIP file. Affected Software ownCloud Server 4.0.10 CVE-2013-5665 ownCloud Server 4.5.5 CVE-2013-5665...

Server: Code execution in /lib/migrate.php

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows authenticated remote attackers to execute arbitrary code by uploading a crafted mount.php file in an imported ZIP file. For more information please consult the official advisory. This advisory is licensed CC BY-...

CVE-2012-5609

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...

Design/Logic Flaw

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file...