SuSE 11.3 Security Update : libvirt (SAT Patch Number 9203)

libvirt has been patched to fix two security issues. Further information is available at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0179 and http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6456 These security issues have been fixed : - Unsafe parsing of XML documents allows...

openSUSE Security Update : acroread (openSUSE-SU-2010:0573-1)

Specially crafted PDF documents could crash acroread or lead to execution of arbitrary code CVE-2010-1240, CVE-2010-2862. This update also incorporate the Adobe Flash Player update APSB10-16 for the bundled flash player parts CVE-2010-0209, CVE-2010-2188, CVE-2010-2213, CVE-2010-2214,...

CVE-2014-3832

Cross-site scripting XSS vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the printunescaped function...

libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read

It was found that libvirt passes the XMLPARSENOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read t...

CSRF in documents - ownCloud

Due to not verifying whether a request was intentionally provided by the user who submitted an request the documents application is vulnerable against several CSRF attacks. An attacker could have used this to arbitrary modify existing files or rename it. Affected Software ownCloud Server 6.0.3...

Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit Title: Multiple Stored XSS Software: Maya EDMS Software Link: http://www.mayan-edms.com/downloads/Mayan%20EDMS%20v0.13.ova Version: 0.13 - latest Author: Dolev Farhi, email: dolevatopenflaredotorg @f1nhack Date: 21.5.2014 Tested on: Kali Linux Vendor homepage: www.mayan-edms.com 1. About...

USN-2214-1 libxml2 vulnerability

Daniel Berrange discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service...

Dropbox Patches Shared Links Privacy Vulnerability

Dropbox has acknowledged and disabled a vulnerable shared links feature that exposed documents stored by the service to third parties. Shared links are a collaboration feature that allows user, especially in a business environment, to share and edit documents. Dropbox rival Intralinks reported th...

Threat Outbreak Alert: Fake Shipping Documents Attachment Email Messages on June 25, 2014

Medium Alert ID: 33903 First Published: 2014 April 22 20:16 GMT Last Updated: 2014 June 26 11:57 GMT Version: 39 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain shipping documents for the recipient. The text in the email message attemp...

Microsoft Excel REPT Function Integer Overflow (MS08-057) - Ver2 (CVE-2008-4019)

Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formula, and various data sources. The common extension used for Microsoft Excel documents is .xls, .xlsx a...

CVE-2014-0514

The Adobe Reader Mobile application before 11.2 for Android does not properly restrict use of JavaScript, which allows remote attackers to execute arbitrary code via a crafted PDF document, a related issue to CVE-2012-6636...

Adobe Reader for Android 11.1.3 - Arbitrary JavaScript Execution

------------------------------------------------------------------------ Adobe Reader for Android exposes insecure Javascript interfaces ------------------------------------------------------------------------ Yorick Koster, April 2014...

Threat Outbreak Alert: Fake Financial Documents Email Messages on April 9, 2014

Medium Alert ID: 33737 First Published: 2014 April 10 13:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claims to contain financial documents email messages for the recipient. The text in the email message attempt...

Ubuntu Update for libyaml-libyaml-perl USN-2161-1

Check for the Version of libyaml-libyaml-perl OpenVAS Vulnerability Test $Id: gbubuntuUSN21611.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for libyaml-libyaml-perl USN-2161-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net Thi...

Fedora 19 : perl-YAML-LibYAML-0.41-4.fc19 (2014-4517)

This update addressed two security issues. CVE-2013-6393: The yamlparserscantaguri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via crafted tags in a YAML...

Ubuntu 12.04 LTS / 12.10 / 13.10 : libyaml-libyaml-perl vulnerabilities (USN-2161-1)

Florian Weimer discovered that libyaml-libyaml-perl incorrectly handled certain large YAML documents. An attacker could use this issue to cause libyaml-libyaml-perl to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2013-6393 Ivan Fratric discovered that...

MiniDuke Malware spreads via Fake Ukraine-related Documents

A year back, Security Researchers from the Antivirus firm Kaspersky found a sophisticated piece of malware which they dubbed as ‘MiniDuke’, designed specifically to collect and steal strategic insights and highly protected political information, which is a subject to states’ security. Now, once...

Threat Outbreak Alert: Fake Bank Documents Email Messages on April 1, 2014

Medium Alert ID: 33610 First Published: 2014 April 1 20:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

Threat Outbreak Alert: Fake Faxed Documents Email Messages on April 2, 2014

Medium Alert ID: 33602 First Published: 2014 April 1 15:40 GMT Last Updated: 2014 April 3 12:20 GMT Version: 3 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain faxed documents for the recipient. The text in the email message attempts to...

CVE-2014-2118

Cisco Prime Security Manager (PRSM) prior to and including version 9.2(.1-2) contains multiple cross-site scripting (XSS) vulnerabilities in dashboard-related HTML pages. The root cause is insufficient input validation in several dashboard HTML parameters, allowing remote attackers to inject arbi...