SA-CONTRIB-2015-047 - Panopoly Magic - Cross Site Scripting (XSS)

This module enables live previews of Panels panes in the modal dialog for adding or editing them. The module doesn't sufficiently filter the pane title when re-rendering the live preview. This vulnerability is mitigated by the fact that an attacker must have permission to add or edit Panels panes...

New CMS 2.1 Local File Inclusion

=============================================== + TITLE : NEW CMS Local File Inclusion Vulnerability /proc/self/environ + VENDOR : http://new-cms.org/index.php?lng=it&mod=download&pg=indice + VERSION : 2.1 or Later + AUTHOR : R3vanBastard + TESTED ON : Windows + DORK : "New CMS"...

CentOS 7 : kernel (CESA-2014:1971)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Kernel: HID: OOB write in magicmouse driver

An out-of-bounds write flaw was found in the way the Apple Magic Mouse/Trackpad multi-touch driver handled Human Interface Device HID reports with an invalid size. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on...

openSUSE Security Update : file (openSUSE-SU-2014:1516-1)

file was updated to fix one security issue. This security issue was fixed : - Out-of-bounds read in elf note headers CVE-2014-3710. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

[ MDVSA-2014:201 ] kernel

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:201 http://www.mandriva.com/en/support/security/ Package : kernel Date : October 21, 2014 Affected: Business Server 1.0 Problem Description: Multiple vulnerabilities has been found and corrected in the Linux...

TinyRise 最新版注射获取敏感信息

简要描述： TinyRise 最新版注射获取敏感信息 详细说明： 主要问题出在filterclass.php: public static function text$str $config = HTMLPurifierConfig::createDefault; $cachedir=Tiny::getPath'cache'."/htmlpurifier/"; if!fileexists$cachedir File::mkdir$cachedir; $config = HTMLPurifierConfig::createDefault; //配置 缓存目录...

Information disclosure

The Magicam Photo Magic Editor aka mobi.magicam.editor application 5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Bilingual Magic Ball Relajo aka com.wBilingualMagicBallRelajo application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7652

The CVE-2014-7652 entry concerns the Magicam Photo Magic Editor (aka mobi.magicam.editor) for Android (version 5.0). The vulnerability is that the application does not verify X.509 SSL certificates, enabling potential man-in-the-middle attackers to spoof servers and obtain sensitive information v...

CVE-2014-7664

The CVE-2014-7664 entry concerns a Android app named Bilingual Magic Ball Relajo (com.wBilingualMagicBallRelajo, version 0.1). The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and access sensitive information via ...

CVE-2014-7464

The Magic Stamp aka vn.avagame.apotatem application 2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Bilingual Magic Ball aka com.wBilingualMagicBall application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7464

CVE-2014-7464 concerns the Android app “The Magic Stamp” (aka vn.avagame.apotatem) version 2.8, where the client fails to verify X.509 certificates from SSL servers. This root cause allows MITM attackers to spoof the server and potentially leak sensitive information via a crafted certificate. The...

CVE-2014-7446

The Bilingual Magic Ball aka com.wBilingualMagicBall application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7446

The CVE-2014-7446 entry concerns the Android app “The Bilingual Magic Ball” (com.wBilingualMagicBall) version 0.1, where SSL connections do not verify X.509 certificates. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificat...

CVE-2014-7371

CVE-2014-7371 affects the Android app “Magic Balloonman Marty Boone” (com.app_martyboone.layout) version 1.400. The issue is that the app does not verify X.509 certificates from SSL servers, which enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted ...

Kernel: HID: OOB write in magicmouse driver

An out-of-bounds write flaw was found in the way the Apple Magic Mouse/Trackpad multi-touch driver handled Human Interface Device HID reports with an invalid size. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on...

DEBIAN-CVE-2014-3181

Multiple stack-based buffer overflows in the magicmouserawevent function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service system crash or possibly execute arbitrary code via a crafted...

CVE-2014-3181

Multiple stack-based buffer overflows in the magicmouserawevent function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service system crash or possibly execute arbitrary code via a crafted...