Updated qemu packages fixes security vulnerabilities

Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process crash. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw in the NE2000 NIC emulation....

MGASA-2015-0397 Updated qemu packages fixes security vulnerabilities

Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process crash. CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered a heap buffer overflow flaw in the NE2000 NIC emulation....

Reflected Cross-Site Scripting (XSS) in SourceBans

High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...

Securifi Almond Security Bypass Vulnerability

Securifi Almond is a wireless router product from Securifi. Securifi Almond uses static source ports for DNS queries in the local network, allowing an attacker to exploit a vulnerability that can be exploited to spoof DNS responses and allow Almond LAN clients to connect to incorrect or malicious...

kernel: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements.

It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets...

Moderate: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Updated kernel-rt packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

kernel: netfilter connection tracking extensions denial of service

An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing t...

kernel: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements.

It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets...

Reflected Cross-Site Scripting (XSS) in iTop

High-Tech Bridge Security Research Lab discovered vulnerability in iTop, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. iTop is a critical application, which is used to cover the entire set of ITIL processes. Successful attack on this web...

kernel: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements.

It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets...

Cisco ASR 1000 IOS XE PPPoE Process Denial of Service Vulnerability

Cisco IOS XE on ASR 1000 routers is a set of operating systems for use in ASR 1000 series router devices from Cisco. A security vulnerability exists in the PPPoE process of Cisco IOS XE version 3.5.0S on Cisco ASR 1000 devices. A remote attacker can exploit this vulnerability to cause a denial of...

A year later, Yahoo finally fixes the SSRF vulnerability-vulnerability warning-the black bar safety net

! After a lapse of a year later, Yahoo finally fixes the image processing system of the SSRF service end request forgery）vulnerabilities. SSRF service end request forgery）vulnerability, also known as XSPA（cross-site port attacks, the problem exists in the application program loading the user...

Cisco NX-OS LLDP Handling Denial of Service Vulnerability

Cisco NX-OS software is a data center-class operating system that embodies modular design, sustainability, and maintainability. A security vulnerability in the processing of LLDP messages by Cisco NX-OS allows a remote user on the local network to send specially crafted LLDP messages to an...

Pearson ProctorCache contains hard coded credentials

Overview The Pearson ProctorCache software uses a hard coded password for administrative tasks. Description The ProctorCache is designed to cache the testing content, as well as cache the responses and maintain a client list of active test-takers. ProctorCache is a server software package install...

D-Link DSP-W110 Command Execution / SQL Injection / File Upload

D-Link DSP-W110 - multiple vulnerabilities ---- Discovered by: ---- Peter Adkins ---- Access: ---- Local network; unauthenticated access. ---- Tracking and identifiers: ---- CVE - None allocated. ---- Platforms / Firmware confirmed affected: ---- D-Link DSP-W110 Rev A - v1.05b01 ---- Notes: ----...

CVE-2015-0756

Cisco Wireless LAN Controller WLC devices with software 7.41.1 allow remote attackers to cause a denial of service wireless-networking outage via crafted TCP traffic on the local network, aka Bug ID CSCug67104...

Improper access control

Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified...

CVE-2014-2174

Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified...

CVE-2014-2174

Cisco TelePresence T, TelePresence TE, and TelePresence TC before 7.1 do not properly implement access control, which allows remote attackers to obtain root privileges by sending packets on the local network and allows physically proximate attackers to obtain root privileges via unspecified...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2588-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2588-1 advisory. A stack overflow was discovered in the the microcode loader for the intel x86 platform. A local attacker could exploit this flaw to cause a denial of...