CVE-2013-5042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS...

Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20131121)

Two flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. CVE-2013-3559, CVE-2013-4083 Several denial of service flaws were found in Wireshark. Wireshark...

PT-2013-1368

Name of the Vulnerable Software and Affected Versions Microsoft ASP.NET SignalR versions 1.1.x through 1.1.3 Microsoft ASP.NET SignalR versions 2.0.x through 2.0.0 Visual Studio Team Foundation Server version 2013 Description The issue is related to a cross-site scripting XSS vulnerability. This...

PT-2013-6243

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 2.1 Description The issue is related to the ff combine frame function in libavcodec/parser.c, which does not properly handle certain memory-allocation errors. This can be exploited by remote attackers using crafted dat...

CVE-2013-0855

Integer overflow in the alacdecodeclose function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec ALAC data, which triggers an out-of-bounds array access...

CVE-2013-0855

Integer overflow in the alacdecodeclose function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec ALAC data, which triggers an out-of-bounds array access...

XADV-2013003 Linux Kernel fbdev Driver arcfb_write() Overflow

+----------------------------------------------------------------+ | XADV-2013003 Linux Kernel fbdev Driver arcfbwrite Overflow | +----------------------------------------------------------------+ Vulnerable versions: - linux kernel 3.12 = - linux kernel 2.6.x Testbed: linux kernel 2.6.18 Type:...

DEBIAN-CVE-2013-0860

The fferframeend function in libavcodec/errorresilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data...

Null pointer dereference

The fferframeend function in libavcodec/errorresilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data...

PT-2013-2659

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.0.4 FFmpeg versions 1.1.x prior to 1.1.1 Description The issue arises from the ff er frame end function in libavcodec/error resilience.c, which fails to properly verify that a frame is fully initialized. This allows...

PT-2013-1091

Name of the Vulnerable Software and Affected Versions libav versions prior to 1.0.4 Description The issue concerns multiple vulnerabilities in the libav package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability...

PT-2013-1095

Name of the Vulnerable Software and Affected Versions libav versions prior to 1.1 Description The issue concerns multiple vulnerabilities in the libav package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability o...

PT-2013-2661

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 1.1.2 Description The issue is caused by multiple integer overflows in the process frame obj function, which can be triggered by crafted image dimensions in LucasArts Smush video data. This leads to an out-of-bounds...

CVE-2013-6698

The web interface on Cisco Wireless LAN Controller WLC devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bu...

Updated glibc package fixes security vulnerabilities

Updated glibc packages fixes the following security issues: Integer overflow in string/strcolll.c in the GNU C Library aka glibc or libc6 2.17 and earlier allows context-dependent attackers to cause a denial of service crash or possibly execute arbitrary code via a long string, which triggers a...

CVE-2013-6698

CVE-2013-6698 concerns the web interface of Cisco Wireless LAN Controller (WLC). The vulnerability stems from insufficient restrictions on iframe usage, enabling cross-frame scripting (XFS) and clickjacking-like attacks via a crafted page. Affected component is the WLC web UI; root cause is inade...

Cisco Wireless LAN Controller Cross-Frame Scripting Vulnerability

A vulnerability in the web interface of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, remote attacker to execute a cross-frame scripting XFS attack. The vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a...

CVE-2013-6698: Undefined Security Weakness

The web interface on Cisco Wireless LAN Controller WLC devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting XFS" issue, aka Bu...

PT-2013-6084

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controller WLC affected versions not specified Description The issue is related to a cross-frame scripting XFS problem, where the web interface does not properly restrict the use of IFRAME elements. This makes it easier for...

samba: clickjacking vulnerability in SWAT

The Samba Web Administration Tool SWAT in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a 1 FRAME or 2 IFRAME element...