The vulnerability of the multimedia player iTunes and the iOS operating system allows a hacker to execute arbitrary code or trigger a service failure.

The vulnerability of the WebKit component in the multimedia player iTunes and the iOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure by using a specially crafted...

USN-2758-1: PHP vulnerabilities

It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. CVE-2015-5589 It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker cou...

Discuz! X3.1 逻辑错误漏洞

Discuz! X3.1 在完成任务时（home.php?mod=draw&do=view&id=xx），任务先前的状态缺少判断完成任务的链接形如：home.php?mod=draw&do=view&id=xx这个地址最终在 source\class\classtask.php 中被处理约第370行：function draw$id global $G; if!$this-task = C::t'commontask'-fetchbyuid$G'uid', $id showmessage'tasknonexistence'; elseif$this-task'status' != 0...

DEBIAN-CVE-2015-6248

The ptvcursoradd function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service application crash via a crafted packet...

JVN#17611367: Apache Tapestry deserializes untrusted data

Apache Tapestry is a framework for creating Java web applications. Apache Tapestry contains an interface where client side serialized data sent to the server is deserialized after it is received by the server. This data serialization / deserialization process does not contain data validation...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

[USN-2658-1] PHP vulnerabilities

========================================================================== Ubuntu Security Notice USN-2658-1 July 06, 2015 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Debian DLA-242-1 : imagemagick security update

This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats. Most of those potential security problems do not have a CVE number assigned. While the security implications of all of these problems are not all fully known, ...

[SECURITY] [DLA 242-1] imagemagick security update

Package : imagemagick Version : 8:6.6.0.4-3+squeeze6 CVE ID : CVE-2012-3437 CVE-2014-8354 CVE-2014-8355 CVE-2014-8562 Debian Bug : 773834 767240 683285 692367 This update fixes a large number of potential security problems due to insufficient data validation when parsing different input formats...

DLA-242-1 imagemagick - security update

Bulletin has no description...

Adobe Flash Player JSONP Cross-Site Request Forgery (APSB15-11: CVE-2015-3096)

A cross-site request forgery CSRF vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an insufficient validation of data from JSONP callback APIs. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Microsoft Windows AVI File Data Validation Integer Overflow (MS09-038) - Ver2 (CVE-2009-1546)

Audio Video Interleave AVI is a special case of Resource Interchange File Format RIFF.This file type used with applications that capture, edit, and play back audio-video sequences. The vulnerability is due to an error in the Windows component responsible for processing AVI files that does not...

Enter: HTML injection in email sent by romit.io

Issue It is possible for the attacker to inject arbitary HTML code in the email sent by romit.io as " OR "img src="sth bad" OR !-- 2. Save your settings. 3. Share your wallet with any user by providing phone number. Thanks crab...

MS15-033: Description of the Microsoft Office for Mac 2011 14.4.9 update: April 14, 2015

Describes a security update that addresses vulnerabilities by correcting how Excel and other affected software validate data when they parse specially crafted Office files.IntroductionMicrosoft has released security bulletin MS15-033. This security bulletin contains all the relevant information...

Unspecified Vulnerability in Cisco IOS Autonomic Networking Infrastructure Feature

Cisco IOS is an operating system developed by Cisco for its network devices. A security vulnerability exists in the Autonomic Networking Infrastructure ANI feature of Cisco IOS, which stems from the program's failure to adequately validate data. A remote attacker could exploit the vulnerability b...

CVE-2014-7252

Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local user...

CVE-2014-7252

The CVE-2014-7252 entry relates to multiple improper data validation vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processors. The Syslink driver, used in devices such as NTT DOCOMO ARROWS and SoftBank SHARP handsets, allows local users to execute arbitrary code or read ...

CVE-2014-7252

Multiple unspecified vulnerabilities in the Syslink driver for Texas Instruments OMAP mobile processor, as used on NTT DOCOMO ARROWS Tab LTE F-01D, ARROWS X LTE F-05D, Disney Mobile on docomo F-08D, REGZA Phone T-01D, and PRADA phone by LG L-02D; and SoftBank SHARP handsets 102SH allow local user...

JVN#67792023: Multiple improper data validation vulnerabilities in Syslink driver for Texas Instruments OMAP mobile processors

The OMAP mobile processor provided by Texas Instruments is used in some Android tablets, smartphones and other devices. The Syslink driver for some OMAP mobile processors is used to implement the communication of processes between the host and slave processors. The Syslink driver contains multipl...

Pandora FMS 5.1SP1 Cross Site Scripting

I. VULNERABILITY ------------------------- XSS Reflected in Page visualization agents in Pandora FMS v5.1SP1 - Revisión PC141031 II. BACKGROUND Pandora FMS is the monitoring software chosen by several companies all around the world for managing their IT infrastructure. Besides ensuring high...