Exploit for Out-of-bounds Read in Openssl

Pacemaker Attempts to abuse OpenSSL clients that are vulnera...

Microsoft Word File Converting CVE-2014-1757 Remote Code Execution Vulnerability

Description Microsoft Word is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Microsoft...

destoon最新版某敏感功能xss指哪打哪

简要描述： 之前提交过，官方说补了 http://www.wooyun.org/bugs/wooyun-2014-053573 于是我看看修补以后的效果。 详细说明： 这是最新版的过滤富文本xss的函数： 已经解决了之前的问题。用expressi0n替换了expression。看似似乎没问题了。 其实还有各种问题。IE还有一个容错特性，那就是expression，其中加斜杠\，在IE6789上是可以触发的（当然我没测试更高版本）。所以，利用这个特性，可以绕过dsafe函数的过滤。 这时候，我们测试： 照弹无误：...

CVE-2014-1761

Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attacker...

Microsoft Word CVE-2014-1761 Remote Memory Corruption Vulnerability

Description Microsoft Word is prone to a remote memory-corruption vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Microsoft...

Ubuntu Update for gtk+3.0 USN-2149-2

Check for the Version of gtk+3.0 OpenVAS Vulnerability Test $Id: gbubuntuUSN21492.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for gtk+3.0 USN-2149-2 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Ubuntu: Security Advisory (USN-2149-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 12.04 LTS / 12.10 : gtk+3.0 update (USN-2149-2)

USN-2149-1 fixed a vulnerability in librsvg. This update provides a compatibility fix for GTK+ to work with the librsvg security update. It was discovered that librsvg would load XML external entities by default. If a user were tricked into viewing a specially crafted SVG file, an attacker could...

HackerOne: javascript: and mailto: links are allowed on users' profiles

For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...

[DeviceIOView] View data transfer between a software and device driver

DeviceIOView allows you to watch the data transfer between a software or service and a device driver DeviceIoControl calls. For each call to a device driver, the following information is displayed: Handle, Control Code, number of input bytes, number of output bytes, the name of the device handle,...

Fedora 19 : ReviewBoard-1.7.22-1.fc19 (2014-3420)

New upstream security release 1.7.22 - http://www.reviewboard.org/docs/releasenotes/reviewboa rd/1.7.22/ - Security Fixes : - An XSS vulnerability was found in the Search field's auto-complete. - New Features : - Added support for anonymous access to public Local Sites. - Added support for...

Fedora 20 : ReviewBoard-1.7.22-2.fc20 (2014-3446)

New upstream security release 1.7.22 - http://www.reviewboard.org/docs/releasenotes/reviewboa rd/1.7.22/ - Security Fixes : - An XSS vulnerability was found in the Search field's auto-complete. - New Features : - Added support for anonymous access to public Local Sites. - Added support for...

Kernel: AACRAID Driver compat IOCTL missing capability check

The aaccompatioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAPSYSRAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call...

Security Update for Microsoft Silverlight (KB2932677)

This security update to Silverlight includes fixes outlined in KB 2932677. This update is backward compatible with web applications built using previous versions of Silverlight...

[VNC Password Recovery v2.0] All-in-one VNC Password Decoder Tool

VNC Password Recovery is the FREE software to instantly recover VNC password stored by popular VNC Servers. It automatically detects the encrypted VNC password stored in the file system or registry by various VNC server applications. Then it quickly decrypts it and display the original VNC...

Ubuntu Update for linux USN-2107-1

Check for the Version of linux OpenVAS Vulnerability Test $Id: gbubuntuUSN21071.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for linux USN-2107-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; yo...

MGASA-2014-0071 Updated xbmc package fixes a security vulnerability

Due to flaws in the embedded copy of libDCR, a fork of dcraw.c, in the embedded copy of CxImage, opening a specially crafted photo file could trigger a division by zero, an infinite loop, or a null pointer dereference, resulting in a denial of service CVE-2013-1438. This update fixes those flaws...

Updated xbmc package fixes a security vulnerability

Due to flaws in the embedded copy of libDCR, a fork of dcraw.c, in the embedded copy of CxImage, opening a specially crafted photo file could trigger a division by zero, an infinite loop, or a null pointer dereference, resulting in a denial of service CVE-2013-1438. This update fixes those flaws...

[SECURITY] Fedora 19 Update: zarafa-7.1.8-1.fc19

The Zarafa Collaboration Platform is a Microsoft Exchange replacement. The Open Source Collaboration provides an integration with your existing Linux mail server, native mobile phone support by ActiveSync compatibility and a webaccess with 'Look & Feel' similar to Outlook using Ajax. Including an...

[SECURITY] Fedora 20 Update: python3-3.3.2-9.fc20

Python 3 is a new version of the language that is incompatible with the 2.x line of releases. The language is mostly the same, but many details, especi ally how built-in objects like dictionaries and strings work, have changed considerably, and a lot of deprecated features have finally been remov...