3638 matches found
PT-2014-1986
Name of the Vulnerable Software and Affected Versions Vivint Sky Control Panel version 1.1.1.9926 Description The issue is related to the lack of authentication for critical functions in the Vivint Sky Control Panel web application. This allows a remote attacker to enable and disable the alarm...
USN-2330-1 thunderbird vulnerabilities
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman and JW Wang discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to...
DEBIAN-CVE-2014-5369
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network...
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities
Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities Mpay24 PrestaShop Payment Module Multiple Vulnerabilities - · Affected Vendor: Mpay24 - · Affected Software: Mpay24 Payment Module - · Affected Version: 1.5 and earlier - · Issue Type: SQL injection and information disclosure - ·...
Backoff Sinkhole Reveals Sorry Point-of-Sale Security
Kaspersky Lab researchers say that a recent analysis of two Backoff malware command and control servers paints “a very bleak picture of the state of point-of-sale security.” Kaspersky Lab sinkholed two of the malware’s command and control servers. In just two days, nearly 100 infected systems,...
UBUNTU-CVE-2014-3562
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory...
CVE-2014-5240
Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...
Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20140813)
It was discovered that the OBJobj2txt function could fail to properly NUL-terminate its output. This could possibly cause an application using OpenSSL functions to format fields of X.509 certificates to disclose portions of its memory. CVE-2014-3508 Multiple flaws were discovered in the way OpenS...
Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20140813)
A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. A malicious server could possibly use this flaw to cause a multi-threaded TLS/SSL client using OpenSSL to write into freed memory, causing the client to crash or execut...
[DLA 36-1] polarssl security update
Package : polarssl Version : 1.2.9-1deb6u2 CVE ID : CVE-2014-4911 Debian Bug : 754655 Denial of Service against GCM enabled servers and clients...
389-ds: unauthenticated information disclosure
It was found that when replication was enabled for each attribute in Red Hat Directory Server / 389 Directory Server, which is the default configuration, the server returned replicated metadata when the directory was searched while debugging was enabled. A remote attacker could use this flaw to...
USN-2296-1 thunderbird vulnerabilities
Christian Holler, David Keeler and Byron Campen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or...
CVE-2014-5022
Cross-site scripting XSS vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field...
CVE-2014-5022
Removed by vendor...
Mbedthis AppWeb 2.2.2 URL Protocol Format String Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/24454/info Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. This...
PhPepperShop 2.5 'USER_ARTIKEL_HANDLING_AUFRUF.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37707/info PhPepperShop is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...
WinVNC Web Server <= 3.3.3r7 - GET Overflow
No description provided by source. $Id: winvnchttpget.rb 7724 2009-12-06 05:50:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...
Nessus 2.0.x LibNASL Arbitrary Code Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7664/info Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox...
HP JetDirect PJL Interface Universal Path Traversal
No description provided by source. Exploit Title: HP JetDirect PJL Interface Universal Path Traversal Date: Aug 7, 2011 Author: Myo Soe YGN Ethical Hacker Group - http://yehg.net/ Software Link: http://www.hp.com Version: All Tested on: HP LaserJet Pxxxx Series $Id: $ This file is part of the...
Apple MacOS Internet Explorer 3/4/5 File Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3935/info A vulnerability has been discovered in MacOS systems running Internet Explorer 5.1 and earlier. MacOS X is not affected by this issue. File URLs may be used by a malicious webmaster to execute programs on a web...