OpenJDK: MediaTracker created Component instances with unnecessary privileges (Swing, 7020198)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availabili...

JDK: unspecified vulnerability fixed in 6u26 (Deployment)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment...

JDK: unspecified vulnerability fixed in 6u29 (Deployment)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 6 Update 27 and earlier, when running on Windows, allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown...

OpenJDK: mutable repository identifiers (CORBA, 7110704)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via...

OpenJDK: KeyboardFocusManager focus stealing (AWT, 7110683)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality an...

OpenJDK: Deserialization allows creation of mutable SignedObject (Deserialization, 6618658)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to...

Apache Fixes Information Disclosure Vuln in Shindig

The Apache Software Foundation released a new version of Shindig, a framework for Web applications yesterday, fixing what the collective has deemed an important information disclosure vulnerability. According to a post on Seclists.org by Ryan Baxter, an Apache Shindig committer, the problem affec...

Apache Struts Update Patches Two Vulnerabilities

The group behind Apache have pushed out a new version of Struts, fixing two issues in the framework that were giving developers difficulties over the past several weeks. The Apache Software Foundation posted version 2.3.15.3 of the framework online Tuesday. The release fixes an access control...

Adaudit Plus Online Demo CSRF / Poor Password Passing

================================================================================================================================================= ADAUDIT PLUS ON-LINE DEMO TomCat Directory Listing / CSRF / Password field Submited using GET Method / OPTIONS Method...

Microsoft Office Web Apps Remote Code Execution vulnerability (2834052)

This host is missing an important security update according to Microsoft Bulletin MS13-067. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

MS13-084: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2885089)

The versions of Office SharePoint Server, SharePoint Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft Office Services and...

MS13-084: Description of the security update for Office Web Apps Server 2013: October 8, 2013

This security update corrects the way affected Microsoft software validates data when parsing specially crafted Office files. It also changes the configuration of SharePoint pages to provide additional protection against click-jacking attacks.INTRODUCTIONMicrosoft has released security bulletin...

Ice Cold Apps Servers Ultimate 6.0.2(12) Remote Command Execution

Ice Cold Apps Servers Ultimate version 6.0.212 for Android has no credentials by default and authentication is disabled for telnet/ssh/ftp, allowing remote access to the device's storage. Multiple vulnerabilities in Ice Cold Apps Servers Ulitmate Version 6.0.212 for Android 9/8/13 Larry W...

Ice Cold Apps Servers Ultimate 6.0.2(12) Remote Command Execution

Multiple vulnerabilities in Ice Cold Apps Servers Ulitmate Version 6.0.212 for Android 9/8/13 Larry W. Cashdollar, @larry0 http://www.amazon.com/Ice-Cold-Apps-Servers-Ultimate/dp/B00E00C44G/ref=sr11?s=mobile-apps&ie=UTF8&qid=1378688647 http://www.icecoldapps.com Vulnerabilities There are no...

Firefox For Android Same-Origin Bypass

Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cross-site scripting XSS attacks or obtain password or cookie information, by using a symlink in conjunction with a file: URL for a local file. CVE Number: CVE-2013-1727 Vender...

Firefox For Android Same-Origin Bypass

CVE Number: CVE-2013-1727 Vender Identifier: MFSA 2013-84 Title: Firefox for Android - Same-origin bypass through symbolic links Affected Software: Prior to v24 confirmed on v14 Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc. Issue Status: v24 was released which fixes this...

Design/Logic Flaw

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon...

CVE-2013-5156

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon...

Tiendas Online SQL Injection

Tiendas Online SQL Injection Vulnerability ============================================================================= Last login: Sat Sep 14 01:59:02 on console / / / / / / / / / / / / / : / / / / / / / / / / / / / / / | / / / / / / / / / / / / / // / // / / / / --X-- / / / / / / / / / /...

CVE-2013-3847

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service memory...