Updated virtualbox packages fixes security vulnerabilities

VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x before 4.2.24, and 4.3.x before 4.3.8, when using 3D Acceleration allows local guest OS users to execute arbitrary code on the Chromium server via crafted Chromium network pointer ...

SOL15180 - OpenSSL vulnerability CVE-2013-4353

Recommended action You can eliminate this vulnerability by running a version listed in the Versions known to be not vulnerable column. If the column does not list a version that is newer than the version you are running, then no upgrade candidate currently exists. To mitigate this vulnerability,...

ASUS RT Password Disclosure

http://dnlongen.blogspot.com/2014/04/CVE-2014-2719-Asus-RT-Password-Disclosure.html In mid February, I wrote that a substantial portion of ASUS wireless routers would fail to update their firmware. In fact, the "check for update" function would inform the administrator that the router was fully...

SOL15158 - OpenSSL vulnerability CVE-2013-6450

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

CVE-2013-4694

Stack-based buffer overflow in genjumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a package with a long Skin directory name. NOTE: a second buffer overflow involving a long GUI Search field to mllocal.d...

Stack overflow

Stack-based buffer overflow in genjumpex.dll in Winamp before 5.64 Build 3418 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a package with a long Skin directory name. NOTE: a second buffer overflow involving a long GUI Search field to mllocal.d...

CVE-2014-0633

The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...

Design/Logic Flaw

The GUI in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 does not properly validate session-timeout values, which might make it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation...

Symantec LiveUpdate Administrator SQL注入漏洞

Bugtraq ID:66400 CVE ID:CVE-2014-1645 Symantec LiveUpdate Administrator是一款Symantec产品升级管理程序。 Symantec LiveUpdate Administrator管理GUI不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 Symantec LiveUpdate Administrator 2.x Symantec LiveUpdate Administrator 2.3.2.110已经修复该漏洞，建议用户下载更新：...

ESA-2014-016: EMC VPLEX Multiple Vulnerabilities

ESA-2014-016.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-016: EMC VPLEX Multiple Vulnerabilities EMC Identifier: ESA-2014-016 CVE Identifier: See below for individual CVEs Severity Rating: CVSS v2 Base Score: See below for individual CVSS scores Affected products: All versions from...

Default credentials

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

CVE-2014-1645

CVE-2014-1645 is an SQL injection flaw in Symantec LiveUpdate Administrator (LUA) 2.x up to version 2.3.2.110, affecting the management GUI via forcepasswd.do and related password-recovery paths. The vulnerability allows remote attackers to execute arbitrary SQL commands, potentially exfiltrating...

Symantec LiveUpdate Administrator Unauthenticated/Unauthorized Account Access Modification and SQL i

SUMMARY The management GUI for Symantec LiveUpdate Administrator does not properly protect the forgotten password functionality of the web interface. An unauthorized individual with knowledge of the email address for an authorized LUA user can potentially force an arbitrary password reset leading...

GUI Bugs Expose Information Disclosure, Privilege Escalation

Developers are creating countless information disclosure and privilege escalation vulnerabilities by misusing elements of various graphical user interfaces as a mechanisms for access control, according to a new research paper from the Northeastern University College of Computer and Information...

[Peepdf] PDF Analysis and Creation/Modification Tool

peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it's possible ...

CVE-2014-2122

Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution HCS allows remote attackers to cause a denial of service memory consumption via unspecified vectors, aka Bug ID CSCub58999...

Memory corruption

Memory leak in the GUI in the Impact server in Cisco Hosted Collaboration Solution HCS allows remote attackers to cause a denial of service memory consumption via unspecified vectors, aka Bug ID CSCub58999...

CVE-2014-2122

Cisco Hosted Collaboration Solution (HCS) Impack server GUI contains a memory leak vulnerability that can cause DoS via remote, unauthenticated access. The issue stems from improper packet processing, enabling memory exhaustion on the GUI. Exploitation may require access to trusted internal netwo...

Sql injection

Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...

CVE-2013-4467

Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...