CVE-2015-1274

Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to...

CVE-2015-1274

Removed by vendor...

OpenSSL 'ASN1_item_ex_d2i' Function Denial of Service Vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A denial of service vulnerability exists in the 'ASN1itemexd2i' function of OpenSSL 'crypto/asn1/tasndec.c'. Due to the program faili...

PYSEC-2015-7

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

NSA Official: Support for Compromised Dual EC Algorithm Was 'Regrettable'

In a new article in an academic math journal, the NSA’s former director of research says that the agency’s decision not to withdraw its support of the Dual ECDRBG random number generator after security researchers found weaknesses in it and questioned its provenance was a “regrettable” choice...

USN-2469-1 python-django vulnerabilities

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments. CVE-2015-0219 Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker...

Acunetix-Web-Vulnerability-Scanner

Exploit write-up: http://osandamalith.wordpress.com/2014/04/24/pwning-script-kiddies-acunetix-buffer-overflow/ /!\ Author is not responsible for any damage you cause This POC is for educational purposes only Video: https://www.youtube.com/watch?v=RHaMx8K1GeM while True: try: choice = intrawinput"...

Hurray! Unlocking Your Cell Phone is Officially Legal Again

President Barack Obama signed a bill into law Friday that aims to make it legal for consumers to “unlock” their cell phones in order to change their cell phone service providers without paying for a new phone. The bill is known as the Unlocking Consumer Choice and Wireless Competition Act, which...

InVision: TLS Renegotiation and Denial of Service Attacks on InVision.

Hi, I found a Bug in your website.It's a TLS Renegotiation and Denial of Service Attacks. Description:- A group of hackers known as THC The Hacker's Choice last week released an interesting DoS tool that works at the SSL/TLS layer. The tool is exploiting the fact that, when a new SSL connection i...

Replacing Security Best Practices With Things That Work

NEW YORK–The term “best practices” is high on the list of overused and nearly meaningless phrases that get thrown around in the security field. It forms the basis for regulations such as HIPAA and PCI DSS and yet if you asked a random sample of 10 security people what the phrase meant, you’d like...

CVE-2013-3581

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax 1 wmxState or 2 netState request...

Cross site request forgery (csrf)

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax 1 wmxState or 2 netState request...

CVE-2013-4731

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...

Cross site request forgery (csrf)

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...

CVE-2013-4731

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...

CVE-2013-4731

CVE-2013-4731 affects the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem. The vulnerability is in the web interface’s ajax.cgi. It allows remote attackers to execute arbitrary commands by injecting shell metacharacters in the pip parameter of an Ajax tag_ipPing request. This is a distinct...

CVE-2013-3581

The CVE-2013-3581 entry affects the web interface of the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem. The vulnerability lies in ajax.cgi where remote attackers can obtain sensitive information via Ajax requests (wmxState or netState). The provided documents describe the affected compon...

CVE-2013-3581

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to obtain sensitive information via an Ajax 1 wmxState or 2 netState request...

PT-2013-5164

Name of the Vulnerable Software and Affected Versions Choice Wireless Green Packet WIXFMR-111 4G WiMax modem affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an "Ajax tag ipPing" request...

CVE-2013-4731: Improper Authentication

ajax.cgi in the web interface on the Choice Wireless Green Packet WIXFMR-111 4G WiMax modem allows remote attackers to execute arbitrary commands via shell metacharacters in the pip parameter in an Ajax tagipPing request, a different vulnerability than CVE-2013-3581...